https://packages.wazuh.com/4.7/wazuh-install.sh

MALICIOUS

SUSPICIOUS

• Reads /proc/mounts (likely used to find writable filesystems)

  • firefox (PID: 7937)

• Checks DMI information (probably VM detection)

  • systemd-hostnamed (PID: 8439)

• Executes commands using command-line interpreter

  • gnome-terminal-server (PID: 8452)
  • apt-get (PID: 8533)
  • apt-get (PID: 9414)
  • apt-get (PID: 9831)
  • apt-get (PID: 9873)
  • apt-get (PID: 8902)
  • apt-get (PID: 9381)
  • su (PID: 8478)

• Creates shell script file

  • firefox (PID: 7937)
  • apt-key (PID: 8626)
  • apt-key (PID: 8547)
  • apt-key (PID: 8622)
  • apt-key (PID: 8779)

• Reads information about logins, logouts, and login attempts

  • bash (PID: 8470)
  • sudo (PID: 8477)

• Executes the "rm" command to delete files or directories

  • apt-key (PID: 8547)
  • apt-key (PID: 8626)
  • apt-key (PID: 8622)
  • apt-key (PID: 8779)
  • dpkg (PID: 9396)
  • update-motd-updates-available (PID: 9420)
  • update-motd-updates-available (PID: 8917)
  • dpkg (PID: 9846)
  • update-motd-updates-available (PID: 9879)

• Changes time attribute to hide new files or make changes to the existing one

  • sh (PID: 9418)
  • sh (PID: 9877)

• Creates or rewrites file in the "bin" folder

  • dpkg (PID: 9846)
  • dpkg (PID: 9396)

INFO