86732a4cfbd729746d6b920e56a903729a1d2c60bbd0df93803a508d609aa8bf

persistence privilege_escalation defense_evasion

description	ioc	Process
File opened for modification	/etc/cron.d/manta	2026-10-28_fdc118ba0aaa3c7f0cdae8acea0e88af_dofloo_glassworm_helldown_mirai

Creates/modifies environment variables 1 TTPs 4 IoCs

Creating/modifying environment variables is a common persistence mechanism.

Path Interception by PATH Environment Variable

description	ioc	Process
File opened for modification	/etc/profile	2026-10-28_fdc118ba0aaa3c7f0cdae8acea0e88af_dofloo_glassworm_helldown_mirai
File opened for modification	/etc/bash.bashrc	2026-10-28_fdc118ba0aaa3c7f0cdae8acea0e88af_dofloo_glassworm_helldown_mirai
File opened for modification	/root/.bashrc	2026-10-28_fdc118ba0aaa3c7f0cdae8acea0e88af_dofloo_glassworm_helldown_mirai
File opened for modification	/root/.profile	2026-10-28_fdc118ba0aaa3c7f0cdae8acea0e88af_dofloo_glassworm_helldown_mirai

Enumerates running processes
Discovers information about currently running processes on the system

Modifies init.d 2 TTPs 1 IoCs

Adds/modifies system service, likely for persistence.

Boot or Logon Autostart Execution

RC Scripts

description	ioc	Process
File opened for modification	/etc/init.d/manta	2026-10-28_fdc118ba0aaa3c7f0cdae8acea0e88af_dofloo_glassworm_helldown_mirai

Modifies rc script 2 TTPs 1 IoCs

Adding/modifying system rc scripts is a common persistence mechanism.

Boot or Logon Autostart Execution

RC Scripts

persistence privilege_escalation

description	ioc	Process
File opened for modification	/etc/rc.local	2026-10-28_fdc118ba0aaa3c7f0cdae8acea0e88af_dofloo_glassworm_helldown_mirai

Modifies systemd 2 TTPs 9 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/manta.service	.manta
File opened for modification	/etc/systemd/system/manta.service	2026-10-28_fdc118ba0aaa3c7f0cdae8acea0e88af_dofloo_glassworm_helldown_mirai
File opened for modification	/etc/systemd/system/manta.service	.manta
File opened for modification	/etc/systemd/system/manta.service	.manta
File opened for modification	/etc/systemd/system/manta.service	.manta
File opened for modification	/etc/systemd/system/manta.service	.manta
File opened for modification	/etc/systemd/system/manta.service	2026-10-28_fdc118ba0aaa3c7f0cdae8acea0e88af_dofloo_glassworm_helldown_mirai
File opened for modification	/etc/systemd/system/manta.service	.manta
File opened for modification	/etc/systemd/system/manta.service	.manta

Write file to user bin folder 9 IoCs

description	ioc	Process
File opened for modification	/usr/bin/.manta	2026-10-28_fdc118ba0aaa3c7f0cdae8acea0e88af_dofloo_glassworm_helldown_mirai
File opened for modification	/usr/bin/.manta	.manta
File opened for modification	/usr/bin/.manta	2026-10-28_fdc118ba0aaa3c7f0cdae8acea0e88af_dofloo_glassworm_helldown_mirai
File opened for modification	/usr/bin/.manta	.manta
File opened for modification	/usr/bin/.manta	.manta
File opened for modification	/usr/bin/.manta	.manta
File opened for modification	/usr/bin/.manta	.manta
File opened for modification	/usr/bin/.manta	.manta
File opened for modification	/usr/bin/.manta	.manta

Modifies Bash startup script 2 TTPs 4 IoCs

Boot or Logon Autostart Execution

Unix Shell Configuration Modification

T1546.004

description	ioc	Process
File opened for modification	/root/.bashrc	2026-10-28_fdc118ba0aaa3c7f0cdae8acea0e88af_dofloo_glassworm_helldown_mirai
File opened for modification	/root/.profile	2026-10-28_fdc118ba0aaa3c7f0cdae8acea0e88af_dofloo_glassworm_helldown_mirai
File opened for modification	/etc/profile	2026-10-28_fdc118ba0aaa3c7f0cdae8acea0e88af_dofloo_glassworm_helldown_mirai
File opened for modification	/etc/bash.bashrc	2026-10-28_fdc118ba0aaa3c7f0cdae8acea0e88af_dofloo_glassworm_helldown_mirai

Changes its process name 36 IoCs

description	ioc	pid	Process
Changes the process name, possibly in an attempt to hide itself	[kworker/0:0]	1541	2026-10-28_fdc118ba0aaa3c7f0cdae8acea0e88af_dofloo_glassworm_helldown_mirai
Changes the process name, possibly in an attempt to hide itself	systemd-journal	1541	2026-10-28_fdc118ba0aaa3c7f0cdae8acea0e88af_dofloo_glassworm_helldown_mirai
Changes the process name, possibly in an attempt to hide itself	[kworker/0:0]	1544	2026-10-28_fdc118ba0aaa3c7f0cdae8acea0e88af_dofloo_glassworm_helldown_mirai
Changes the process name, possibly in an attempt to hide itself	(sysv-install)	1603	systemctl
Changes the process name, possibly in an attempt to hide itself	[kworker/0:0]	1669	2026-10-28_fdc118ba0aaa3c7f0cdae8acea0e88af_dofloo_glassworm_helldown_mirai
Changes the process name, possibly in an attempt to hide itself	[kworker/0:0]	1669	2026-10-28_fdc118ba0aaa3c7f0cdae8acea0e88af_dofloo_glassworm_helldown_mirai
Changes the process name, possibly in an attempt to hide itself	[kworker/0:0]	1672	2026-10-28_fdc118ba0aaa3c7f0cdae8acea0e88af_dofloo_glassworm_helldown_mirai
Changes the process name, possibly in an attempt to hide itself	(sysv-install)	1724	systemctl
Changes the process name, possibly in an attempt to hide itself	[kworker/0:0]	1790	.manta
Changes the process name, possibly in an attempt to hide itself	systemd-journal	1790	.manta
Changes the process name, possibly in an attempt to hide itself	[kworker/0:0]	1793	.manta
Changes the process name, possibly in an attempt to hide itself	(sysv-install)	1845	systemctl
Changes the process name, possibly in an attempt to hide itself	[kworker/0:0]	1913	.manta
Changes the process name, possibly in an attempt to hide itself	kthreadd	1913	.manta
Changes the process name, possibly in an attempt to hide itself	[kworker/0:0]	1916	.manta
Changes the process name, possibly in an attempt to hide itself	(sysv-install)	1968	systemctl
Changes the process name, possibly in an attempt to hide itself	[kworker/0:0]	2034	.manta
Changes the process name, possibly in an attempt to hide itself	[kworker/1:0]	2034	.manta
Changes the process name, possibly in an attempt to hide itself	[kworker/0:0]	2037	.manta
Changes the process name, possibly in an attempt to hide itself	(sysv-install)	2089	systemctl
Changes the process name, possibly in an attempt to hide itself	[kworker/0:0]	2155	.manta
Changes the process name, possibly in an attempt to hide itself	[kworker/0:0]	2155	.manta
Changes the process name, possibly in an attempt to hide itself	[kworker/0:0]	2158	.manta
Changes the process name, possibly in an attempt to hide itself	(sysv-install)	2210	systemctl
Changes the process name, possibly in an attempt to hide itself	[kworker/0:0]	2276	.manta
Changes the process name, possibly in an attempt to hide itself	kthreadd	2276	.manta
Changes the process name, possibly in an attempt to hide itself	[kworker/0:0]	2279	.manta
Changes the process name, possibly in an attempt to hide itself	(sysv-install)	2331	systemctl
Changes the process name, possibly in an attempt to hide itself	[kworker/0:0]	2397	.manta
Changes the process name, possibly in an attempt to hide itself	ksoftirqd/0	2397	.manta
Changes the process name, possibly in an attempt to hide itself	[kworker/0:0]	2400	.manta
Changes the process name, possibly in an attempt to hide itself	(sysv-install)	2452	systemctl
Changes the process name, possibly in an attempt to hide itself	[kworker/0:0]	2518	.manta
Changes the process name, possibly in an attempt to hide itself	kthreadd	2518	.manta
Changes the process name, possibly in an attempt to hide itself	[kworker/0:0]	2521	.manta
Changes the process name, possibly in an attempt to hide itself	(sysv-install)	2573	systemctl

Reads runtime system information 64 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/1025/comm	.manta
File opened for reading	/proc/362/comm	.manta
File opened for reading	/proc/20/comm	.manta
File opened for reading	/proc/83/comm	.manta
File opened for reading	/proc/1048/comm	.manta
File opened for reading	/proc/1069/comm	.manta
File opened for reading	/proc/475/comm	2026-10-28_fdc118ba0aaa3c7f0cdae8acea0e88af_dofloo_glassworm_helldown_mirai
File opened for reading	/proc/1676/comm	.manta
File opened for reading	/proc/210/comm	.manta
File opened for reading	/proc/179/comm	.manta
File opened for reading	/proc/1346/comm	.manta
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/491/comm	.manta
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/1094/comm	.manta
File opened for reading	/proc/1272/comm	.manta
File opened for reading	/proc/1056/comm	.manta
File opened for reading	/proc/12/comm	.manta
File opened for reading	/proc/7/comm	.manta
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/180/comm	.manta
File opened for reading	/proc/362/comm	.manta
File opened for reading	/proc/1016/comm	2026-10-28_fdc118ba0aaa3c7f0cdae8acea0e88af_dofloo_glassworm_helldown_mirai
File opened for reading	/proc/1099/comm	2026-10-28_fdc118ba0aaa3c7f0cdae8acea0e88af_dofloo_glassworm_helldown_mirai
File opened for reading	/proc/170/comm	2026-10-28_fdc118ba0aaa3c7f0cdae8acea0e88af_dofloo_glassworm_helldown_mirai
File opened for reading	/proc/362/comm	.manta
File opened for reading	/proc/13/comm	.manta
File opened for reading	/proc/486/comm	.manta
File opened for reading	/proc/1113/comm	.manta
File opened for reading	/proc/954/comm	2026-10-28_fdc118ba0aaa3c7f0cdae8acea0e88af_dofloo_glassworm_helldown_mirai
File opened for reading	/proc/185/comm	.manta
File opened for reading	/proc/479/comm	.manta
File opened for reading	/proc/1073/comm	.manta
File opened for reading	/proc/84/comm	.manta
File opened for reading	/proc/1083/comm	.manta
File opened for reading	/proc/1325/comm	.manta
File opened for reading	/proc/733/comm	2026-10-28_fdc118ba0aaa3c7f0cdae8acea0e88af_dofloo_glassworm_helldown_mirai
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/1005/comm	.manta
File opened for reading	/proc/1216/comm	.manta
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/18/comm	.manta
File opened for reading	/proc/6/comm	2026-10-28_fdc118ba0aaa3c7f0cdae8acea0e88af_dofloo_glassworm_helldown_mirai
File opened for reading	/proc/1/sched	systemctl
File opened for reading	/proc/508/comm	.manta
File opened for reading	/proc/17/comm	.manta
File opened for reading	/proc/26/comm	.manta
File opened for reading	/proc/137/comm	.manta
File opened for reading	/proc/1331/comm	.manta
File opened for reading	/proc/1371/comm	.manta
File opened for reading	/proc/1346/comm	2026-10-28_fdc118ba0aaa3c7f0cdae8acea0e88af_dofloo_glassworm_helldown_mirai
File opened for reading	/proc/954/comm	.manta
File opened for reading	/proc/1073/comm	.manta
File opened for reading	/proc/1121/comm	.manta
File opened for reading	/proc/475/comm	.manta
File opened for reading	/proc/35/comm	2026-10-28_fdc118ba0aaa3c7f0cdae8acea0e88af_dofloo_glassworm_helldown_mirai
File opened for reading	/proc/1346/comm	2026-10-28_fdc118ba0aaa3c7f0cdae8acea0e88af_dofloo_glassworm_helldown_mirai
File opened for reading	/proc/1041/comm	2026-10-28_fdc118ba0aaa3c7f0cdae8acea0e88af_dofloo_glassworm_helldown_mirai
File opened for reading	/proc/994/comm	.manta
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/1056/comm	.manta
File opened for reading	/proc/539/comm	.manta
File opened for reading	/proc/13/comm	2026-10-28_fdc118ba0aaa3c7f0cdae8acea0e88af_dofloo_glassworm_helldown_mirai
File opened for reading	/proc/sys/kernel/osrelease	systemctl

Writes file to shm directory 9 IoCs

Malware can drop malicious files in the shm directory which will run directly from RAM.

description	ioc	Process
File opened for modification	/dev/shm/.manta	.manta
File opened for modification	/dev/shm/.manta	.manta
File opened for modification	/dev/shm/.manta	.manta
File opened for modification	/dev/shm/.manta	.manta
File opened for modification	/dev/shm/.manta	2026-10-28_fdc118ba0aaa3c7f0cdae8acea0e88af_dofloo_glassworm_helldown_mirai
File opened for modification	/dev/shm/.manta	.manta
File opened for modification	/dev/shm/.manta	.manta
File opened for modification	/dev/shm/.manta	2026-10-28_fdc118ba0aaa3c7f0cdae8acea0e88af_dofloo_glassworm_helldown_mirai
File opened for modification	/dev/shm/.manta	.manta

Writes file to tmp directory 18 IoCs

Malware often drops required files in the /tmp directory.

description	ioc	Process
File opened for modification	/tmp/.wd.lock	2026-10-28_fdc118ba0aaa3c7f0cdae8acea0e88af_dofloo_glassworm_helldown_mirai
File opened for modification	/tmp/.manta	.manta
File opened for modification	/tmp/.manta	.manta
File opened for modification	/tmp/.wd.lock	.manta
File opened for modification	/tmp/.manta	.manta
File opened for modification	/tmp/.wd.lock	.manta
File opened for modification	/tmp/.manta	.manta
File opened for modification	/tmp/.manta	2026-10-28_fdc118ba0aaa3c7f0cdae8acea0e88af_dofloo_glassworm_helldown_mirai
File opened for modification	/tmp/.manta	.manta
File opened for modification	/tmp/.wd.lock	.manta
File opened for modification	/tmp/.manta	.manta
File opened for modification	/tmp/.wd.lock	.manta
File opened for modification	/tmp/.wd.lock	.manta
File opened for modification	/tmp/.manta	2026-10-28_fdc118ba0aaa3c7f0cdae8acea0e88af_dofloo_glassworm_helldown_mirai
File opened for modification	/tmp/.wd.lock	2026-10-28_fdc118ba0aaa3c7f0cdae8acea0e88af_dofloo_glassworm_helldown_mirai
File opened for modification	/tmp/.wd.lock	.manta
File opened for modification	/tmp/.manta	.manta
File opened for modification	/tmp/.wd.lock	.manta

/tmp/2026-10-28_fdc118ba0aaa3c7f0cdae8acea0e88af_dofloo_glassworm_helldown_mirai
/tmp/2026-10-28_fdc118ba0aaa3c7f0cdae8acea0e88af_dofloo_glassworm_helldown_mirai
1⤵
- Executes dropped EXE
- Traces itself
- Creates/modifies Cron job
- Creates/modifies environment variables
- Modifies init.d
- Modifies rc script
- Modifies systemd
- Write file to user bin folder
- Modifies Bash startup script
- Changes its process name
- Reads runtime system information
- Writes file to shm directory
- Writes file to tmp directory
PID:1541
- /bin/sh
  sh -c "systemctl daemon-reload 2>/dev/null; systemctl enable manta.service 2>/dev/null"
  2⤵
  PID:1556
- - /bin/systemctl
    systemctl daemon-reload
    3⤵
    PID:1566
- - /bin/systemctl
    systemctl enable manta.service
    3⤵
    - Changes its process name
    PID:1602
  - - /lib/systemd/systemd-sysv-install
      /lib/systemd/systemd-sysv-install enable manta
      4⤵
      PID:1603
    - - /usr/bin/getopt
        
        getopt -o r: --long root: -- enable manta
        5⤵
        
        PID:1604
    - - /usr/sbin/update-rc.d
        
        /usr/sbin/update-rc.d manta defaults
        5⤵
        
        PID:1605
      - /usr/local/sbin/systemctl
        
        systemctl daemon-reload
        6⤵
        
        PID:1606
      - /usr/local/bin/systemctl
        
        systemctl daemon-reload
        6⤵
        
        PID:1606
      - /usr/sbin/systemctl
        
        systemctl daemon-reload
        6⤵
        
        PID:1606
      - /usr/bin/systemctl
        
        systemctl daemon-reload
        6⤵
        
        PID:1606
      - /sbin/systemctl
        
        systemctl daemon-reload
        6⤵
        
        PID:1606
      - /bin/systemctl
        
        systemctl daemon-reload
        6⤵
        
        PID:1606
    - - /usr/sbin/update-rc.d
        
        /usr/sbin/update-rc.d manta enable
        5⤵
        
        PID:1627
      - /usr/local/sbin/systemctl
        
        systemctl daemon-reload
        6⤵
        
        PID:1628
      - /usr/local/bin/systemctl
        
        systemctl daemon-reload
        6⤵
        
        PID:1628
      - /usr/sbin/systemctl
        
        systemctl daemon-reload
        6⤵
        
        PID:1628
      - /usr/bin/systemctl
        
        systemctl daemon-reload
        6⤵
        
        PID:1628
      - /sbin/systemctl
        
        systemctl daemon-reload
        6⤵
        
        PID:1628
      - /bin/systemctl
        
        systemctl daemon-reload
        6⤵
        Reads runtime system information
        
        PID:1628
- /tmp/2026-10-28_fdc118ba0aaa3c7f0cdae8acea0e88af_dofloo_glassworm_helldown_mirai
  /tmp/2026-10-28_fdc118ba0aaa3c7f0cdae8acea0e88af_dofloo_glassworm_helldown_mirai
  2⤵
  - Traces itself
  - Modifies systemd
  - Write file to user bin folder
  - Changes its process name
  - Reads runtime system information
  - Writes file to shm directory
  - Writes file to tmp directory
  PID:1669
- - /bin/sh
    sh -c "systemctl daemon-reload 2>/dev/null; systemctl enable manta.service 2>/dev/null"
    3⤵
    PID:1677
  - - /bin/systemctl
      systemctl daemon-reload
      4⤵
      PID:1702
  - - /bin/systemctl
      systemctl enable manta.service
      4⤵
      Changes its process name
      PID:1723
    - - /lib/systemd/systemd-sysv-install
        
        /lib/systemd/systemd-sysv-install enable manta
        5⤵
        
        PID:1724
      - /usr/bin/getopt
        
        getopt -o r: --long root: -- enable manta
        6⤵
        
        PID:1725
      - /usr/sbin/update-rc.d
        
        /usr/sbin/update-rc.d manta defaults
        6⤵
        
        PID:1726
        
        /usr/local/sbin/systemctl
        
        systemctl daemon-reload
        7⤵
        
        PID:1727
        
        /usr/local/bin/systemctl
        
        systemctl daemon-reload
        7⤵
        
        PID:1727
        
        /usr/sbin/systemctl
        
        systemctl daemon-reload
        7⤵
        
        PID:1727
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        7⤵
        
        PID:1727
        
        /sbin/systemctl
        
        systemctl daemon-reload
        7⤵
        
        PID:1727
        
        /bin/systemctl
        
        systemctl daemon-reload
        7⤵
        
        PID:1727
      - /usr/sbin/update-rc.d
        
        /usr/sbin/update-rc.d manta enable
        6⤵
        
        PID:1748
        
        /usr/local/sbin/systemctl
        
        systemctl daemon-reload
        7⤵
        
        PID:1749
        
        /usr/local/bin/systemctl
        
        systemctl daemon-reload
        7⤵
        
        PID:1749
        
        /usr/sbin/systemctl
        
        systemctl daemon-reload
        7⤵
        
        PID:1749
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        7⤵
        
        PID:1749
        
        /sbin/systemctl
        
        systemctl daemon-reload
        7⤵
        
        PID:1749
        
        /bin/systemctl
        
        systemctl daemon-reload
        7⤵
        Reads runtime system information
        
        PID:1749
- /tmp/.manta
  /tmp/.manta
  2⤵
  - Executes dropped EXE
  - Traces itself
  - Modifies systemd
  - Write file to user bin folder
  - Changes its process name
  - Reads runtime system information
  - Writes file to shm directory
  - Writes file to tmp directory
  PID:1790
- - /bin/sh
    sh -c "systemctl daemon-reload 2>/dev/null; systemctl enable manta.service 2>/dev/null"
    3⤵
    PID:1798
  - - /bin/systemctl
      systemctl daemon-reload
      4⤵
      PID:1823
  - - /bin/systemctl
      systemctl enable manta.service
      4⤵
      Changes its process name
      PID:1844
    - - /lib/systemd/systemd-sysv-install
        
        /lib/systemd/systemd-sysv-install enable manta
        5⤵
        
        PID:1845
      - /usr/bin/getopt
        
        getopt -o r: --long root: -- enable manta
        6⤵
        
        PID:1846
      - /usr/sbin/update-rc.d
        
        /usr/sbin/update-rc.d manta defaults
        6⤵
        
        PID:1847
        
        /usr/local/sbin/systemctl
        
        systemctl daemon-reload
        7⤵
        
        PID:1848
        
        /usr/local/bin/systemctl
        
        systemctl daemon-reload
        7⤵
        
        PID:1848
        
        /usr/sbin/systemctl
        
        systemctl daemon-reload
        7⤵
        
        PID:1848
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        7⤵
        
        PID:1848
        
        /sbin/systemctl
        
        systemctl daemon-reload
        7⤵
        
        PID:1848
        
        /bin/systemctl
        
        systemctl daemon-reload
        7⤵
        
        PID:1848
      - /usr/sbin/update-rc.d
        
        /usr/sbin/update-rc.d manta enable
        6⤵
        
        PID:1869
        
        /usr/local/sbin/systemctl
        
        systemctl daemon-reload
        7⤵
        
        PID:1870
        
        /usr/local/bin/systemctl
        
        systemctl daemon-reload
        7⤵
        
        PID:1870
        
        /usr/sbin/systemctl
        
        systemctl daemon-reload
        7⤵
        
        PID:1870
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        7⤵
        
        PID:1870
        
        /sbin/systemctl
        
        systemctl daemon-reload
        7⤵
        
        PID:1870
        
        /bin/systemctl
        
        systemctl daemon-reload
        7⤵
        Reads runtime system information
        
        PID:1870
- - /tmp/.manta
    /tmp/.manta
    3⤵
    - Executes dropped EXE
    - Traces itself
    - Modifies systemd
    - Write file to user bin folder
    - Changes its process name
    - Reads runtime system information
    - Writes file to shm directory
    - Writes file to tmp directory
    PID:1913
  - - /bin/sh
      sh -c "systemctl daemon-reload 2>/dev/null; systemctl enable manta.service 2>/dev/null"
      4⤵
      PID:1921
    - - /bin/systemctl
        
        systemctl daemon-reload
        5⤵
        
        PID:1946
    - - /bin/systemctl
        
        systemctl enable manta.service
        5⤵
        Changes its process name
        
        PID:1967
      - /lib/systemd/systemd-sysv-install
        
        /lib/systemd/systemd-sysv-install enable manta
        6⤵
        
        PID:1968
        
        /usr/bin/getopt
        
        getopt -o r: --long root: -- enable manta
        7⤵
        
        PID:1969
        
        /usr/sbin/update-rc.d
        
        /usr/sbin/update-rc.d manta defaults
        7⤵
        
        PID:1970
        
        /usr/local/sbin/systemctl
        
        systemctl daemon-reload
        8⤵
        
        PID:1971
        
        /usr/local/bin/systemctl
        
        systemctl daemon-reload
        8⤵
        
        PID:1971
        
        /usr/sbin/systemctl
        
        systemctl daemon-reload
        8⤵
        
        PID:1971
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        8⤵
        
        PID:1971
        
        /sbin/systemctl
        
        systemctl daemon-reload
        8⤵
        
        PID:1971
        
        /bin/systemctl
        
        systemctl daemon-reload
        8⤵
        
        PID:1971
        
        /usr/sbin/update-rc.d
        
        /usr/sbin/update-rc.d manta enable
        7⤵
        
        PID:1992
        
        /usr/local/sbin/systemctl
        
        systemctl daemon-reload
        8⤵
        
        PID:1993
        
        /usr/local/bin/systemctl
        
        systemctl daemon-reload
        8⤵
        
        PID:1993
        
        /usr/sbin/systemctl
        
        systemctl daemon-reload
        8⤵
        
        PID:1993
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        8⤵
        
        PID:1993
        
        /sbin/systemctl
        
        systemctl daemon-reload
        8⤵
        
        PID:1993
        
        /bin/systemctl
        
        systemctl daemon-reload
        8⤵
        
        PID:1993
  - - /tmp/.manta
      /tmp/.manta
      4⤵
      Executes dropped EXE
      Traces itself
      Modifies systemd
      Write file to user bin folder
      Changes its process name
      Reads runtime system information
      Writes file to shm directory
      Writes file to tmp directory
      PID:2034
    - - /bin/sh
        
        sh -c "systemctl daemon-reload 2>/dev/null; systemctl enable manta.service 2>/dev/null"
        5⤵
        
        PID:2042
      - /bin/systemctl
        
        systemctl daemon-reload
        6⤵
        
        PID:2067
      - /bin/systemctl
        
        systemctl enable manta.service
        6⤵
        Changes its process name
        Reads runtime system information
        
        PID:2088
        
        /lib/systemd/systemd-sysv-install
        
        /lib/systemd/systemd-sysv-install enable manta
        7⤵
        
        PID:2089
        
        /usr/bin/getopt
        
        getopt -o r: --long root: -- enable manta
        8⤵
        
        PID:2090
        
        /usr/sbin/update-rc.d
        
        /usr/sbin/update-rc.d manta defaults
        8⤵
        
        PID:2091
        
        /usr/local/sbin/systemctl
        
        systemctl daemon-reload
        9⤵
        
        PID:2092
        
        /usr/local/bin/systemctl
        
        systemctl daemon-reload
        9⤵
        
        PID:2092
        
        /usr/sbin/systemctl
        
        systemctl daemon-reload
        9⤵
        
        PID:2092
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        9⤵
        
        PID:2092
        
        /sbin/systemctl
        
        systemctl daemon-reload
        9⤵
        
        PID:2092
        
        /bin/systemctl
        
        systemctl daemon-reload
        9⤵
        
        PID:2092
        
        /usr/sbin/update-rc.d
        
        /usr/sbin/update-rc.d manta enable
        8⤵
        
        PID:2113
        
        /usr/local/sbin/systemctl
        
        systemctl daemon-reload
        9⤵
        
        PID:2114
        
        /usr/local/bin/systemctl
        
        systemctl daemon-reload
        9⤵
        
        PID:2114
        
        /usr/sbin/systemctl
        
        systemctl daemon-reload
        9⤵
        
        PID:2114
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        9⤵
        
        PID:2114
        
        /sbin/systemctl
        
        systemctl daemon-reload
        9⤵
        
        PID:2114
        
        /bin/systemctl
        
        systemctl daemon-reload
        9⤵
        
        PID:2114
    - - /tmp/.manta
        
        /tmp/.manta
        5⤵
        Executes dropped EXE
        Traces itself
        Modifies systemd
        Write file to user bin folder
        Changes its process name
        Reads runtime system information
        Writes file to shm directory
        Writes file to tmp directory
        
        PID:2155
      - /bin/sh
        
        sh -c "systemctl daemon-reload 2>/dev/null; systemctl enable manta.service 2>/dev/null"
        6⤵
        
        PID:2163
        
        /bin/systemctl
        
        systemctl daemon-reload
        7⤵
        
        PID:2188
        
        /bin/systemctl
        
        systemctl enable manta.service
        7⤵
        Changes its process name
        Reads runtime system information
        
        PID:2209
        
        /lib/systemd/systemd-sysv-install
        
        /lib/systemd/systemd-sysv-install enable manta
        8⤵
        
        PID:2210
        
        /usr/bin/getopt
        
        getopt -o r: --long root: -- enable manta
        9⤵
        
        PID:2211
        
        /usr/sbin/update-rc.d
        
        /usr/sbin/update-rc.d manta defaults
        9⤵
        
        PID:2212
        
        /usr/local/sbin/systemctl
        
        systemctl daemon-reload
        10⤵
        
        PID:2213
        
        /usr/local/bin/systemctl
        
        systemctl daemon-reload
        10⤵
        
        PID:2213
        
        /usr/sbin/systemctl
        
        systemctl daemon-reload
        10⤵
        
        PID:2213
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        10⤵
        
        PID:2213
        
        /sbin/systemctl
        
        systemctl daemon-reload
        10⤵
        
        PID:2213
        
        /bin/systemctl
        
        systemctl daemon-reload
        10⤵
        Reads runtime system information
        
        PID:2213
        
        /usr/sbin/update-rc.d
        
        /usr/sbin/update-rc.d manta enable
        9⤵
        
        PID:2234
        
        /usr/local/sbin/systemctl
        
        systemctl daemon-reload
        10⤵
        
        PID:2235
        
        /usr/local/bin/systemctl
        
        systemctl daemon-reload
        10⤵
        
        PID:2235
        
        /usr/sbin/systemctl
        
        systemctl daemon-reload
        10⤵
        
        PID:2235
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        10⤵
        
        PID:2235
        
        /sbin/systemctl
        
        systemctl daemon-reload
        10⤵
        
        PID:2235
        
        /bin/systemctl
        
        systemctl daemon-reload
        10⤵
        
        PID:2235
      - /tmp/.manta
        
        /tmp/.manta
        6⤵
        Executes dropped EXE
        Traces itself
        Modifies systemd
        Write file to user bin folder
        Changes its process name
        Reads runtime system information
        Writes file to shm directory
        Writes file to tmp directory
        
        PID:2276
        
        /bin/sh
        
        sh -c "systemctl daemon-reload 2>/dev/null; systemctl enable manta.service 2>/dev/null"
        7⤵
        
        PID:2284
        
        /bin/systemctl
        
        systemctl daemon-reload
        8⤵
        
        PID:2309
        
        /bin/systemctl
        
        systemctl enable manta.service
        8⤵
        Changes its process name
        
        PID:2330
        
        /lib/systemd/systemd-sysv-install
        
        /lib/systemd/systemd-sysv-install enable manta
        9⤵
        
        PID:2331
        
        /usr/bin/getopt
        
        getopt -o r: --long root: -- enable manta
        10⤵
        
        PID:2332
        
        /usr/sbin/update-rc.d
        
        /usr/sbin/update-rc.d manta defaults
        10⤵
        
        PID:2333
        
        /usr/local/sbin/systemctl
        
        systemctl daemon-reload
        11⤵
        
        PID:2334
        
        /usr/local/bin/systemctl
        
        systemctl daemon-reload
        11⤵
        
        PID:2334
        
        /usr/sbin/systemctl
        
        systemctl daemon-reload
        11⤵
        
        PID:2334
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        11⤵
        
        PID:2334
        
        /sbin/systemctl
        
        systemctl daemon-reload
        11⤵
        
        PID:2334
        
        /bin/systemctl
        
        systemctl daemon-reload
        11⤵
        
        PID:2334
        
        /usr/sbin/update-rc.d
        
        /usr/sbin/update-rc.d manta enable
        10⤵
        
        PID:2355
        
        /usr/local/sbin/systemctl
        
        systemctl daemon-reload
        11⤵
        
        PID:2356
        
        /usr/local/bin/systemctl
        
        systemctl daemon-reload
        11⤵
        
        PID:2356
        
        /usr/sbin/systemctl
        
        systemctl daemon-reload
        11⤵
        
        PID:2356
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        11⤵
        
        PID:2356
        
        /sbin/systemctl
        
        systemctl daemon-reload
        11⤵
        
        PID:2356
        
        /bin/systemctl
        
        systemctl daemon-reload
        11⤵
        
        PID:2356
        
        /tmp/.manta
        
        /tmp/.manta
        7⤵
        Executes dropped EXE
        Traces itself
        Modifies systemd
        Write file to user bin folder
        Changes its process name
        Reads runtime system information
        Writes file to shm directory
        Writes file to tmp directory
        
        PID:2397
        
        /bin/sh
        
        sh -c "systemctl daemon-reload 2>/dev/null; systemctl enable manta.service 2>/dev/null"
        8⤵
        
        PID:2405
        
        /bin/systemctl
        
        systemctl daemon-reload
        9⤵
        
        PID:2430
        
        /bin/systemctl
        
        systemctl enable manta.service
        9⤵
        Changes its process name
        Reads runtime system information
        
        PID:2451
        
        /lib/systemd/systemd-sysv-install
        
        /lib/systemd/systemd-sysv-install enable manta
        10⤵
        
        PID:2452
        
        /usr/bin/getopt
        
        getopt -o r: --long root: -- enable manta
        11⤵
        
        PID:2453
        
        /usr/sbin/update-rc.d
        
        /usr/sbin/update-rc.d manta defaults
        11⤵
        
        PID:2454
        
        /usr/local/sbin/systemctl
        
        systemctl daemon-reload
        12⤵
        
        PID:2455
        
        /usr/local/bin/systemctl
        
        systemctl daemon-reload
        12⤵
        
        PID:2455
        
        /usr/sbin/systemctl
        
        systemctl daemon-reload
        12⤵
        
        PID:2455
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        12⤵
        
        PID:2455
        
        /sbin/systemctl
        
        systemctl daemon-reload
        12⤵
        
        PID:2455
        
        /bin/systemctl
        
        systemctl daemon-reload
        12⤵
        
        PID:2455
        
        /usr/sbin/update-rc.d
        
        /usr/sbin/update-rc.d manta enable
        11⤵
        
        PID:2476
        
        /usr/local/sbin/systemctl
        
        systemctl daemon-reload
        12⤵
        
        PID:2477
        
        /usr/local/bin/systemctl
        
        systemctl daemon-reload
        12⤵
        
        PID:2477
        
        /usr/sbin/systemctl
        
        systemctl daemon-reload
        12⤵
        
        PID:2477
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        12⤵
        
        PID:2477
        
        /sbin/systemctl
        
        systemctl daemon-reload
        12⤵
        
        PID:2477
        
        /bin/systemctl
        
        systemctl daemon-reload
        12⤵
        
        PID:2477
        
        /tmp/.manta
        
        /tmp/.manta
        8⤵
        Traces itself
        Modifies systemd
        Write file to user bin folder
        Changes its process name
        Reads runtime system information
        Writes file to shm directory
        Writes file to tmp directory
        
        PID:2518
        
        /bin/sh
        
        sh -c "systemctl daemon-reload 2>/dev/null; systemctl enable manta.service 2>/dev/null"
        9⤵
        
        PID:2526
        
        /bin/systemctl
        
        systemctl daemon-reload
        10⤵
        
        PID:2551
        
        /bin/systemctl
        
        systemctl enable manta.service
        10⤵
        Changes its process name
        
        PID:2572
        
        /lib/systemd/systemd-sysv-install
        
        /lib/systemd/systemd-sysv-install enable manta
        11⤵
        
        PID:2573
        
        /usr/bin/getopt
        
        getopt -o r: --long root: -- enable manta
        12⤵
        
        PID:2574
        
        /usr/sbin/update-rc.d
        
        /usr/sbin/update-rc.d manta defaults
        12⤵
        
        PID:2575
        
        /usr/local/sbin/systemctl
        
        systemctl daemon-reload
        13⤵
        
        PID:2576
        
        /usr/local/bin/systemctl
        
        systemctl daemon-reload
        13⤵
        
        PID:2576
        
        /usr/sbin/systemctl
        
        systemctl daemon-reload
        13⤵
        
        PID:2576
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        13⤵
        
        PID:2576
        
        /sbin/systemctl
        
        systemctl daemon-reload
        13⤵
        
        PID:2576
        
        /bin/systemctl
        
        systemctl daemon-reload
        13⤵
        Reads runtime system information
        
        PID:2576
        
        /usr/sbin/update-rc.d
        
        /usr/sbin/update-rc.d manta enable
        12⤵
        
        PID:2597
        
        /usr/local/sbin/systemctl
        
        systemctl daemon-reload
        13⤵
        
        PID:2598
        
        /usr/local/bin/systemctl
        
        systemctl daemon-reload
        13⤵
        
        PID:2598
        
        /usr/sbin/systemctl
        
        systemctl daemon-reload
        13⤵
        
        PID:2598
        
        /usr/bin/systemctl
        
        systemctl daemon-reload
        13⤵
        
        PID:2598
        
        /sbin/systemctl
        
        systemctl daemon-reload
        13⤵
        
        PID:2598
        
        /bin/systemctl
        
        systemctl daemon-reload
        13⤵
        
        PID:2598

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Cron

Persistence

Boot or Logon Autostart Execution

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

Create or Modify System Process

T1543

Systemd Service

T1543.002

Event Triggered Execution

T1546

Unix Shell Configuration Modification

T1546.004

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

Scheduled Task/Job

T1053

Cron

Privilege Escalation

Boot or Logon Autostart Execution

XDG Autostart Entries

T1547.013

Boot or Logon Initialization Scripts

T1037

RC Scripts

Create or Modify System Process

T1543

Systemd Service

T1543.002

Event Triggered Execution

T1546

Unix Shell Configuration Modification

T1546.004

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable

Scheduled Task/Job

T1053

Cron

Defense Evasion

Hijack Execution Flow

T1574

Path Interception by PATH Environment Variable