# Attack 3 sudo hive-passwd j65 kj675; sudo pkill Xorg; sudo pkill x11 vnc; uname -a
### Collected Files  
After these systems were compromised, the attackers downloaded files or programs from various sources so that they could use them to further exploit the system. The downloaded file types are _plain text, executable, shell script, Perl script, Python program, HTML, archived_ (tar) and JSON. After removing _plain text_, _HTML_ and JSON files, the last row of Table 3 indicates the total number that each honeypot received, and they are not substantially different. However, Aster seemed to collect the lowest amount of files, which could be explained by the lowest number of connections it received (cf. Table 1).  
To understand their content, we submitted the SHA-256 hashes of these files to www.virustotal.com (accessed on 15 April 2022), which analyses and keeps records of files from over 70 antivirus scanners to understand their contents. If virustotal.com has the record of the hash of a submitted file, it will return its information, such as size, suggested threat, reputation, first submission date, last submission date and labels from antivirus scanners. We aggregated these results by using their common generic type, for example, malware, to describe their specific types, such as trojan.linux/mirai or trojan.linux/xorddos.  
\begin{table}
\begin{tabular}{l c c c c} \hline \hline  & **Asgard** & **Midgard** & **Cowrie** & **Aster** \\ \hline Unique attack sequences & 30.37\% (65) & 24.62\% (49) & 22.88\% (35) & 36.91\% (55) \\ \hline Attack sequences shared by 2 attacks & 7.01\% (15) & 10.55\% (21) & 12.42\% (19) & 11.41\% (17) \\ \hline Attack sequences shared by 3 attacks & 7.01\% (15) & 5.03\% (10) & 3.92\% (6) & 4.03\% (6) \\ \hline Attack sequences shared by more than 3 attacks & 55.61\% (119) & 59.80\% (119) & 60.78\% (93) & 47.65\% (71) \\ \hline
**Total of attack sequences** & **100\% (214)** & **100\% (199)** & **100\% (153)** & **100\% (149)** \\ \hline \hline \end{tabular}
\end{table}
Table 2: An attack sequence is the sequence of commands that were executed in an attack. It is unique when it belongs to a single attack. If it is shared by two attacks, it is referred to as an attack sequence shared by two attacks, etc.; this table shows the percentage and the actual number of attack sequences that each system received.  
Table 3 shows the type breakdown of all the downloaded files across all systems, and we found that the attackers generally infected the honeypots with malware, mostly of Mirai variants. They also exploited the honeypots to mine cryptocurrencies by predominantly using the XMRig ([[https://xmrig.com/](https://xmrig.com/)]([https://xmrig.com/](https://xmrig.com/)), accessed on 15 April 2022), a cross-platform miner. Apart from Aster, Asgard, Midgard and Cowrie were installed with botnets that could communicate with their C&C servers using Internet Relay Chat (irc). The attackers also used a _speedtest_ program written in Python to gather the information on the network connection on the three high-interactions, and they also used a hack tool that includes a port scanner and some other tools.  
Other attacks identified as _shell downloaders_ are the attacks in which they execute commands such as wget or curl to download files before executing them. The last groups of attacks are shell scripts that generally run tests to look for some specific platforms and download different versions of the same program for different platforms before executing them.