Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
linux_arm5.elf
|
ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), statically linked, Go BuildID=ubEEXdTtnm96zB7q9wqK/FWHN6rjOgYgbWB2CYmkf/IVeAv0RTeYhHhk6zhFUi/6m3UApuQSY-Tfc41p9ys,
stripped
|
initial sample
|
 |
|
|
/boot/System.img.config
|
ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), statically linked, Go BuildID=ubEEXdTtnm96zB7q9wqK/FWHN6rjOgYgbWB2CYmkf/IVeAv0RTeYhHhk6zhFUi/6m3UApuQSY-Tfc41p9ys,
stripped
|
dropped
|
|
|
|
/etc/32678
|
POSIX shell script, ASCII text executable
|
dropped
|
|
|
|
/etc/crontab
|
ASCII text
|
dropped
|
|
|
|
/etc/id.services.conf
|
ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), statically linked, Go BuildID=ubEEXdTtnm96zB7q9wqK/FWHN6rjOgYgbWB2CYmkf/IVeAv0RTeYhHhk6zhFUi/6m3UApuQSY-Tfc41p9ys,
stripped
|
dropped
|
|
|
|
/etc/init.d/linux_kill
|
POSIX shell script, ASCII text executable
|
dropped
|
|
|
|
/etc/init.d/ssh
|
POSIX shell script, ASCII text executable
|
dropped
|
|
|
|
/etc/profile.d/bash_config
|
ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), statically linked, Go BuildID=ubEEXdTtnm96zB7q9wqK/FWHN6rjOgYgbWB2CYmkf/IVeAv0RTeYhHhk6zhFUi/6m3UApuQSY-Tfc41p9ys,
stripped
|
dropped
|
|
|
|
/etc/profile.d/bash_config.sh
|
a /bin/sh\n/etc/profile.d/bash_config script, ASCII text executable, with no line terminators
|
dropped
|
|
|
|
/usr/bin/dir
|
ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), statically linked, Go BuildID=ubEEXdTtnm96zB7q9wqK/FWHN6rjOgYgbWB2CYmkf/IVeAv0RTeYhHhk6zhFUi/6m3UApuQSY-Tfc41p9ys,
stripped
|
dropped
|
|
|
|
/usr/bin/find
|
ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), statically linked, Go BuildID=ubEEXdTtnm96zB7q9wqK/FWHN6rjOgYgbWB2CYmkf/IVeAv0RTeYhHhk6zhFUi/6m3UApuQSY-Tfc41p9ys,
stripped
|
dropped
|
|
|
|
/usr/bin/ls
|
ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), statically linked, Go BuildID=ubEEXdTtnm96zB7q9wqK/FWHN6rjOgYgbWB2CYmkf/IVeAv0RTeYhHhk6zhFUi/6m3UApuQSY-Tfc41p9ys,
stripped
|
dropped
|
|
|
|
/usr/bin/lsof
|
ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), statically linked, Go BuildID=ubEEXdTtnm96zB7q9wqK/FWHN6rjOgYgbWB2CYmkf/IVeAv0RTeYhHhk6zhFUi/6m3UApuQSY-Tfc41p9ys,
stripped
|
dropped
|
|
|
|
/usr/bin/netstat
|
ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), statically linked, Go BuildID=ubEEXdTtnm96zB7q9wqK/FWHN6rjOgYgbWB2CYmkf/IVeAv0RTeYhHhk6zhFUi/6m3UApuQSY-Tfc41p9ys,
stripped
|
dropped
|
|
|
|
/usr/bin/ps
|
ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), statically linked, Go BuildID=ubEEXdTtnm96zB7q9wqK/FWHN6rjOgYgbWB2CYmkf/IVeAv0RTeYhHhk6zhFUi/6m3UApuQSY-Tfc41p9ys,
stripped
|
dropped
|
|
|
|
/usr/bin/ss
|
ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), statically linked, Go BuildID=ubEEXdTtnm96zB7q9wqK/FWHN6rjOgYgbWB2CYmkf/IVeAv0RTeYhHhk6zhFUi/6m3UApuQSY-Tfc41p9ys,
stripped
|
dropped
|
|
|
|
/usr/lib/libdlrpcld.so
|
ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), statically linked, Go BuildID=ubEEXdTtnm96zB7q9wqK/FWHN6rjOgYgbWB2CYmkf/IVeAv0RTeYhHhk6zhFUi/6m3UApuQSY-Tfc41p9ys,
stripped
|
dropped
|
|
|
|
/usr/lib/system-monitor
|
ELF 32-bit LSB executable, ARM, EABI5 version 1 (SYSV), statically linked, Go BuildID=ubEEXdTtnm96zB7q9wqK/FWHN6rjOgYgbWB2CYmkf/IVeAv0RTeYhHhk6zhFUi/6m3UApuQSY-Tfc41p9ys,
stripped
|
dropped
|
|
|
|
/.img
|
a /bin/sh\n/usr/lib/libdlrpcld.so script, ASCII text executable, with no line terminators
|
dropped
|
||
|
/memfd:snapd-env-generator (deleted)
|
ASCII text
|
dropped
|
||
|
/run/crond.pid
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.0S541n (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.0vppkn (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.0yDGUp (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.1038so (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.17Y3xl (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.19rnSm (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.2W0Q9o (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.3Fk25m (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.3okdDp (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.5H6e6l (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.5Kkjpm (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.5Ns2xp (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.61JBZm (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.7OKBeo (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.7dErcq (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.7p8Awo (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.81B12l (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.87yTwp (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.8DDsfm (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.8Q77Hn (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.8epUXo (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.9jmLDl (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.A3KI0p (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.ACOfem (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.AgDdJn (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.D7Xw2o (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.EEFfVo (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.EaqAsm (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.Eq3cJn (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.F3dhFn (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.Fk54qm (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.FvhWXo (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.GDPXjp (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.H0Cuwp (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.HcTC4n (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.I9nF2m (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.IbTYUo (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.IiLVQl (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.JFvNHn (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.JTvVzl (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.Kd1VMn (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.L6xOen (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.LTns4l (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.LlujHo (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.MmdWNp (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.Mw9mvn (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.OZ0Uon (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.POg0am (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.PRsHBm (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.PWKhDl (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.Pf9elp (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.QQpGDn (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.R2oKfp (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.RA9Atn (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.RCKiwn (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.Rf3lPp (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.RrQ4So (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.T1z89p (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.TqHptn (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.U4YZhn (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.VFXhVp (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.VXazuo (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.XUoTyo (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.XhUZvm (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.YR9lRl (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.Yn31Ao (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.aYajwn (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.acXh0o (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.adjDen (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.b4P3Tm (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.baWgAl (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.cvvYep (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.dYPqBo (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.doXoep (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.eflprn (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.f7O0Fl (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.g43Cmo (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.gSQpLm (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.h8xuap (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.hxoaJm (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.iX7dQm (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.iZgfhn (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.j6G6Zn (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.jUTlHo (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.lISh4l (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.nmc02m (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.o6Bvbo (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.oaMhjm (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.otzkkp (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.qAjWSp (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.qGek4m (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.rEHN9p (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.rRx40l (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.rfUTaq (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.t7bYGm (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.tOIuxm (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.uClmwp (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.uXStLl (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.uZvHHp (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.uqP3qn (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.vJAyXn (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.vUVSzl (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.vgGkGl (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.vj2aim (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.wEjqQl (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.wX839l (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.wlFbTm (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.xlL9Po (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.xsEhKn (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.ym5Top (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.z7Wy4m (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.zIKwKm (deleted)
|
ASCII text
|
dropped
|
||
|
/tmp/qemu-open.ziP0Hn (deleted)
|
ASCII text
|
dropped
|
||
|
/usr/lib/systemd/system/linux.service
|
ASCII text
|
dropped
|
||
|
/var/log/btmp
|
data
|
dropped
|
There are 126 hidden files, click here to show them.
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
/tmp/linux_arm5.elf
|
/tmp/linux_arm5.elf
|
||
|
/tmp/linux_arm5.elf
|
-
|
||
|
/bin/bash
|
/bin/bash -c /etc/32678&
|
||
|
/bin/bash
|
-
|
||
|
/etc/32678
|
/etc/32678
|
||
|
/etc/32678
|
-
|
||
|
/usr/bin/sleep
|
sleep 60
|
||
|
/tmp/linux_arm5.elf
|
-
|
||
|
/usr/sbin/service
|
service crond start
|
||
|
/usr/sbin/service
|
-
|
||
|
/usr/bin/basename
|
basename /usr/sbin/service
|
||
|
/usr/sbin/service
|
-
|
||
|
/usr/bin/basename
|
basename /usr/sbin/service
|
||
|
/usr/sbin/service
|
-
|
||
|
/usr/bin/systemctl
|
systemctl --quiet is-active multi-user.target
|
||
|
/usr/sbin/service
|
-
|
||
|
/usr/sbin/service
|
-
|
||
|
/usr/bin/systemctl
|
systemctl list-unit-files --full --type=socket
|
||
|
/usr/sbin/service
|
-
|
||
|
/usr/bin/sed
|
sed -ne s/\\.socket\\s*[a-z]*\\s*$/.socket/p
|
||
|
/usr/bin/systemctl
|
systemctl start crond.service
|
||
|
/tmp/linux_arm5.elf
|
-
|
||
|
/tmp/linux_arm5.elf
|
/tmp/linux_arm5.elf
|
||
|
/tmp/linux_arm5.elf
|
-
|
||
|
/usr/sbin/update-rc.d
|
update-rc.d linux_kill defaults
|
||
|
/usr/sbin/update-rc.d
|
-
|
||
|
/usr/bin/systemctl
|
systemctl daemon-reload
|
||
|
/tmp/linux_arm5.elf
|
-
|
||
|
/bin/bash
|
/bin/bash -c "cd /boot;systemctl daemon-reload;systemctl enable linux.service;systemctl start linux.service;journalctl -xe
--no-pager"
|
||
|
/bin/bash
|
-
|
||
|
/usr/bin/systemctl
|
systemctl daemon-reload
|
||
|
/bin/bash
|
-
|
||
|
/usr/bin/systemctl
|
systemctl enable linux.service
|
||
|
/bin/bash
|
-
|
||
|
/usr/bin/systemctl
|
systemctl start linux.service
|
||
|
/bin/bash
|
-
|
||
|
/usr/bin/journalctl
|
journalctl -xe --no-pager
|
||
|
/tmp/linux_arm5.elf
|
-
|
||
|
/bin/bash
|
/bin/bash -c "cd /boot;ausearch -c 'System.img.conf' --raw | audit2allow -M my-Systemimgconf;semodule -X 300 -i my-Systemimgconf.pp"
|
||
|
/bin/bash
|
-
|
||
|
/bin/bash
|
-
|
||
|
/bin/bash
|
-
|
||
|
/tmp/linux_arm5.elf
|
-
|
||
|
/usr/bin/bash
|
bash -c "echo \"*/1 * * * * root /.img \" >> /etc/crontab"
|
||
|
/tmp/linux_arm5.elf
|
-
|
||
|
/usr/bin/renice
|
renice -20 6271
|
||
|
/tmp/linux_arm5.elf
|
-
|
||
|
/usr/bin/mount
|
mount -o bind /tmp/ /proc/6271
|
||
|
/tmp/linux_arm5.elf
|
-
|
||
|
/usr/sbin/service
|
service cron start
|
||
|
/usr/sbin/service
|
-
|
||
|
/usr/bin/basename
|
basename /usr/sbin/service
|
||
|
/usr/sbin/service
|
-
|
||
|
/usr/bin/basename
|
basename /usr/sbin/service
|
||
|
/usr/sbin/service
|
-
|
||
|
/usr/bin/systemctl
|
systemctl --quiet is-active multi-user.target
|
||
|
/usr/sbin/service
|
-
|
||
|
/usr/sbin/service
|
-
|
||
|
/usr/bin/systemctl
|
systemctl list-unit-files --full --type=socket
|
||
|
/usr/sbin/service
|
-
|
||
|
/usr/bin/sed
|
sed -ne s/\\.socket\\s*[a-z]*\\s*$/.socket/p
|
||
|
/usr/bin/systemctl
|
systemctl start cron.service
|
||
|
/tmp/linux_arm5.elf
|
-
|
||
|
/usr/bin/systemctl
|
systemctl start crond.service
|
||
|
/usr/lib/systemd/systemd
|
-
|
||
|
/usr/lib/systemd/system-environment-generators/snapd-env-generator
|
/usr/lib/systemd/system-environment-generators/snapd-env-generator
|
||
|
/usr/lib/systemd/systemd
|
-
|
||
|
/usr/lib/systemd/system-environment-generators/snapd-env-generator
|
/usr/lib/systemd/system-environment-generators/snapd-env-generator
|
||
|
/usr/lib/systemd/systemd
|
-
|
||
|
/usr/lib/systemd/system-environment-generators/snapd-env-generator
|
/usr/lib/systemd/system-environment-generators/snapd-env-generator
|
||
|
/usr/lib/systemd/systemd
|
-
|
||
|
/boot/System.img.config
|
/boot/System.img.config
|
||
|
/boot/System.img.config
|
-
|
||
|
/usr/bin/pkill
|
pkill -9 32678
|
||
|
/boot/System.img.config
|
-
|
||
|
/usr/bin/sh
|
sh -c /etc/32678&
|
||
|
/usr/bin/sh
|
-
|
||
|
/etc/32678
|
/etc/32678
|
||
|
/etc/32678
|
-
|
||
|
/usr/bin/sleep
|
sleep 60
|
||
|
/etc/32678
|
-
|
||
|
/etc/id.services.conf
|
/etc/id.services.conf
|
||
|
/etc/id.services.conf
|
-
|
||
|
/usr/bin/pkill
|
pkill -9 32678
|
||
|
/etc/id.services.conf
|
-
|
||
|
/usr/bin/sh
|
sh -c /etc/32678&
|
||
|
/usr/bin/sh
|
-
|
||
|
/etc/32678
|
/etc/32678
|
||
|
/etc/32678
|
-
|
||
|
/usr/bin/sleep
|
sleep 60
|
||
|
/etc/id.services.conf
|
-
|
||
|
/usr/sbin/service
|
service crond start
|
||
|
/usr/sbin/service
|
-
|
||
|
/usr/bin/basename
|
basename /usr/sbin/service
|
||
|
/usr/sbin/service
|
-
|
||
|
/usr/bin/basename
|
basename /usr/sbin/service
|
||
|
/usr/sbin/service
|
-
|
||
|
/usr/bin/systemctl
|
systemctl --quiet is-active multi-user.target
|
||
|
/usr/sbin/service
|
-
|
||
|
/usr/sbin/service
|
-
|
||
|
/usr/bin/systemctl
|
systemctl list-unit-files --full --type=socket
|
||
|
/usr/sbin/service
|
-
|
||
|
/usr/bin/sed
|
sed -ne s/\\.socket\\s*[a-z]*\\s*$/.socket/p
|
||
|
/usr/bin/systemctl
|
systemctl start crond.service
|
||
|
/etc/id.services.conf
|
-
|
||
|
/etc/id.services.conf
|
/etc/id.services.conf
|
||
|
/boot/System.img.config
|
-
|
||
|
/usr/sbin/service
|
service crond start
|
||
|
/usr/sbin/service
|
-
|
||
|
/usr/bin/basename
|
basename /usr/sbin/service
|
||
|
/usr/sbin/service
|
-
|
||
|
/usr/bin/basename
|
basename /usr/sbin/service
|
||
|
/usr/sbin/service
|
-
|
||
|
/usr/bin/systemctl
|
systemctl --quiet is-active multi-user.target
|
||
|
/usr/sbin/service
|
-
|
||
|
/usr/sbin/service
|
-
|
||
|
/usr/bin/systemctl
|
systemctl list-unit-files --full --type=socket
|
||
|
/usr/sbin/service
|
-
|
||
|
/usr/bin/sed
|
sed -ne s/\\.socket\\s*[a-z]*\\s*$/.socket/p
|
||
|
/usr/bin/systemctl
|
systemctl start crond.service
|
||
|
/boot/System.img.config
|
-
|
||
|
/boot/System.img.config
|
/boot/System.img.config
|
||
|
/usr/sbin/sshd
|
-
|
||
|
/usr/sbin/sshd
|
/usr/sbin/sshd -D -R
|
||
|
/usr/sbin/sshd
|
-
|
||
|
/usr/sbin/sshd
|
/usr/sbin/sshd -D -R
|
||
|
/usr/sbin/sshd
|
-
|
||
|
/usr/sbin/sshd
|
-
|
||
|
/usr/sbin/sshd
|
/usr/sbin/sshd -D -R
|
||
|
/usr/sbin/sshd
|
-
|
||
|
/usr/lib/udisks2/udisksd
|
-
|
||
|
/usr/sbin/dumpe2fs
|
dumpe2fs -h /dev/dm-0
|
||
|
/usr/lib/systemd/systemd
|
-
|
||
|
/usr/sbin/cron
|
/usr/sbin/cron -f
|
There are 124 hidden processes, click here to show them.
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
http://www.baidu.com/search/spider.html)
|
unknown
|
||
|
http://search.msn.com/msnbot.htm
|
unknown
|
||
|
http://149.88.76.121:8088/password.txt
|
149.88.76.121
|
||
|
http://misc.yahoo.com.cn/help.html)crypto/rand:
|
unknown
|
||
|
http://www.baidu.com/search/spider.html)000102030405060708091011121314151617181920212223242526272829
|
unknown
|
||
|
https://www.so.com/s?q=index
|
unknown
|
||
|
http://help.yahoo.com/help/us/ysearch/slurp)x509:
|
unknown
|
||
|
http://www.google.com/mobile/adsbot.html)
|
unknown
|
||
|
http://www.huaweisymantec.com/cn/IRL/spider)Mozilla/5.0
|
unknown
|
||
|
http://www.baidu.com/search/spider.html)http2:
|
unknown
|
||
|
http://yandex.com/bots)http:
|
unknown
|
||
|
http://www.baidu.com/search/spider.html)Mozilla/5.0
|
unknown
|
||
|
http://www.entireweb.com/about/search_tech/speedy_spider/)text/html
|
unknown
|
||
|
http://www.majestic12.co.uk/bot.php?
|
unknown
|
||
|
http://www.haosou.com/help/help_3_2.htmlMozilla/5.0
|
unknown
|
||
|
https://www.baidu.com/s?wd=insufficient
|
unknown
|
||
|
http://www.youdao.com/help/webmaster/spider/;)reflect:
|
unknown
|
||
|
https://search.yahoo.com/search?p=illegal
|
unknown
|
There are 8 hidden URLs, click here to show them.
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
78789.dns.army
|
149.88.76.121
|
||
|
www.google.com
|
142.250.185.100
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
109.202.202.202
|
unknown
|
Switzerland
|
||
|
149.88.76.121
|
78789.dns.army
|
United States
|
||
|
91.189.91.43
|
unknown
|
United Kingdom
|
||
|
91.189.91.42
|
unknown
|
United Kingdom
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
7fe930021000
|
page read and write
|
|||
|
7f3d075ca000
|
page read and write
|
|||
|
5579241bd000
|
page execute read
|
|||
|
7fea3e294000
|
page read and write
|
|||
|
7fea3e475000
|
page read and write
|
|||
|
7f87c8a56000
|
page read and write
|
|||
|
7f87c9426000
|
page read and write
|
|||
|
7fea3df23000
|
page read and write
|
|||
|
7fcea8524000
|
page read and write
|
|||
|
7fea3e59e000
|
page read and write
|
|||
|
557927eb4000
|
page read and write
|
|||
|
7fcea8850000
|
page read and write
|
|||
|
7f7004652000
|
page read and write
|
|||
|
7fe938524000
|
page read and write
|
|||
|
7fe9382ca000
|
page execute read
|
|||
|
7fe93881a000
|
page read and write
|
|||
|
7fcfaf379000
|
page read and write
|
|||
|
7fe938c0f000
|
page read and write
|
|||
|
7fea37fff000
|
page read and write
|
|||
|
7f3d1ef3d000
|
page read and write
|
|||
|
7f6efc021000
|
page read and write
|
|||
|
7ffd4cff5000
|
page read and write
|
|||
|
7f70058ec000
|
page read and write
|
|||
|
7f86c0021000
|
page read and write
|
|||
|
55e0d1372000
|
page read and write
|
|||
|
7f6f00524000
|
page read and write
|
|||
|
7f87c37fe000
|
page read and write
|
|||
|
7fea3d8c4000
|
page read and write
|
|||
|
7fcfaea6f000
|
page read and write
|
|||
|
7fcea0021000
|
page read and write
|
|||
|
7f3d1ebca000
|
page read and write
|
|||
|
7fea3e5c2000
|
page read and write
|
|||
|
55601360a000
|
page read and write
|
|||
|
5560115f5000
|
page read and write
|
|||
|
7f3c18524000
|
page read and write
|
|||
|
7f87c90b5000
|
page read and write
|
|||
|
5604ccb17000
|
page execute and read and write
|
|||
|
7f86c42ca000
|
page execute read
|
|||
|
7f3d1d8ef000
|
page read and write
|
|||
|
7f86bc021000
|
page read and write
|
|||
|
7ffe528a5000
|
page read and write
|
|||
|
7fe934021000
|
page read and write
|
|||
|
7f7005bf6000
|
page read and write
|
|||
|
561708003000
|
page execute read
|
|||
|
7f3d1d9f2000
|
page read and write
|
|||
|
7f3c10021000
|
page read and write
|
|||
|
7f87c4021000
|
page read and write
|
|||
|
7f3d1eed4000
|
page read and write
|
|||
|
7fea3cfb9000
|
page read and write
|
|||
|
7f3d1e87c000
|
page read and write
|
|||
|
55e0d3370000
|
page execute and read and write
|
|||
|
7ffe52938000
|
page execute read
|
|||
|
7f3d18021000
|
page read and write
|
|||
|
7f87c9754000
|
page read and write
|
|||
|
7fcea82ca000
|
page execute read
|
|||
|
7fcfaf355000
|
page read and write
|
|||
|
7f86b8021000
|
page read and write
|
|||
|
7f86c481a000
|
page read and write
|
|||
|
7fea3d0bc000
|
page read and write
|
|||
|
56170be31000
|
page read and write
|
|||
|
7fcfaddb1000
|
page read and write
|
|||
|
7f3d1e859000
|
page read and write
|
|||
|
7ffd4cff9000
|
page execute read
|
|||
|
55e0d45df000
|
page read and write
|
|||
|
7fea3d956000
|
page read and write
|
|||
|
7fcfa7fff000
|
page read and write
|
|||
|
7f87c824e000
|
page read and write
|
|||
|
7fea3e607000
|
page read and write
|
|||
|
7f87c8e4a000
|
page read and write
|
|||
|
7f86c4546000
|
page read and write
|
|||
|
7f87c9730000
|
page read and write
|
|||
|
56170825d000
|
page read and write
|
|||
|
7f87c3fff000
|
page read and write
|
|||
|
7f7004fae000
|
page read and write
|
|||
|
5604cab19000
|
page read and write
|
|||
|
5604ccb2e000
|
page read and write
|
|||
|
7fcfaf22c000
|
page read and write
|
|||
|
7f3d1e28c000
|
page read and write
|
|||
|
7fcfa8021000
|
page read and write
|
|||
|
7f7005c1a000
|
page read and write
|
|||
|
7f7004f1c000
|
page read and write
|
|||
|
7f87c814b000
|
page read and write
|
|||
|
7f86c4858000
|
page read and write
|
|||
|
7fcea8546000
|
page read and write
|
|||
|
7fcfae67b000
|
page read and write
|
|||
|
55792642c000
|
page read and write
|
|||
|
7f700570a000
|
page read and write
|
|||
|
7fea3df46000
|
page read and write
|
|||
|
55792440e000
|
page read and write
|
|||
|
7ffe5c15f000
|
page execute read
|
|||
|
7ffc3a267000
|
page read and write
|
|||
|
7f6fef5ca000
|
page read and write
|
|||
|
7fea3dcb8000
|
page read and write
|
|||
|
7fcea4021000
|
page read and write
|
|||
|
7f3c14021000
|
page read and write
|
|||
|
7f6f00c0f000
|
page read and write
|
|||
|
5560159ab000
|
page read and write
|
|||
|
55601139b000
|
page execute read
|
|||
|
7f87c90d8000
|
page read and write
|
|||
|
7ffe6c3a1000
|
page read and write
|
|||
|
7f87c9244000
|
page read and write
|
|||
|
56170a272000
|
page read and write
|
|||
|
7fcea8c0f000
|
page read and write
|
|||
|
7f6ffffff000
|
page read and write
|
|||
|
7f3d1e5ee000
|
page read and write
|
|||
|
7fcfaee69000
|
page read and write
|
|||
|
7f6ef8021000
|
page read and write
|
|||
|
7fcf975ca000
|
page read and write
|
|||
|
7f87c818c000
|
page read and write
|
|||
|
7fcea881a000
|
page read and write
|
|||
|
7f87c9607000
|
page read and write
|
|||
|
7fea275ca000
|
page read and write
|
|||
|
7f3d1e1fa000
|
page read and write
|
|||
|
7f3d1eef8000
|
page read and write
|
|||
|
7fcfae70d000
|
page read and write
|
|||
|
7f6f002ca000
|
page execute read
|
|||
|
7fe92c021000
|
page read and write
|
|||
|
7f6fff7fe000
|
page read and write
|
|||
|
55e0d1118000
|
page execute read
|
|||
|
561708254000
|
page read and write
|
|||
|
7f7000021000
|
page read and write
|
|||
|
7f3d17fff000
|
page read and write
|
|||
|
7ffe6c3e6000
|
page execute read
|
|||
|
5560135f3000
|
page execute and read and write
|
|||
|
55e0d3387000
|
page read and write
|
|||
|
7fcfaecfd000
|
page read and write
|
|||
|
7f87c9799000
|
page read and write
|
|||
|
7f7005acd000
|
page read and write
|
|||
|
7ffc3a3f9000
|
page execute read
|
|||
|
5560115ec000
|
page read and write
|
|||
|
7f7005c5f000
|
page read and write
|
|||
|
557926415000
|
page execute and read and write
|
|||
|
5604ca8bf000
|
page execute read
|
|||
|
7f3d1e9e8000
|
page read and write
|
|||
|
7fea3e0b2000
|
page read and write
|
|||
|
7fea3cffa000
|
page read and write
|
|||
|
7f3c0c021000
|
page read and write
|
|||
|
7f6ef4021000
|
page read and write
|
|||
|
7f86c4524000
|
page read and write
|
|||
|
7fcfaf04b000
|
page read and write
|
|||
|
7f3d1d930000
|
page read and write
|
|||
|
7f700559e000
|
page read and write
|
|||
|
7f3d177fe000
|
page read and write
|
|||
|
7fcfa77fe000
|
page read and write
|
|||
|
56170a25b000
|
page execute and read and write
|
|||
|
7f6f00546000
|
page read and write
|
|||
|
7f7004714000
|
page read and write
|
|||
|
7f3c182ca000
|
page execute read
|
|||
|
7f87c8ae8000
|
page read and write
|
|||
|
7f700557b000
|
page read and write
|
|||
|
7f3d1edab000
|
page read and write
|
|||
|
55e0d1369000
|
page read and write
|
|||
|
7f7004611000
|
page read and write
|
|||
|
7f7005310000
|
page read and write
|
|||
|
7fea38021000
|
page read and write
|
|||
|
7fcfaf3be000
|
page read and write
|
|||
|
7ffe5c14b000
|
page read and write
|
|||
|
5604cab10000
|
page read and write
|
|||
|
7f86c4c0f000
|
page read and write
|
|||
|
7fe938546000
|
page read and write
|
|||
|
7fcfade73000
|
page read and write
|
|||
|
7fcfadd70000
|
page read and write
|
|||
|
7fea377fe000
|
page read and write
|
|||
|
557924417000
|
page read and write
|
|||
|
7fcfaecda000
|
page read and write
|
|||
|
7fe93884e000
|
page read and write
|
|||
|
7f3c18c0f000
|
page read and write
|
|||
|
5604cdbab000
|
page read and write
|
|||
|
7fce9c021000
|
page read and write
|
|||
|
7f87b35ca000
|
page read and write
|
|||
|
7f3c18546000
|
page read and write
|
There are 161 hidden memdumps, click here to show them.