Edit tour
Linux
Analysis Report
ZwoYU6sMuf.elf
Overview
General Information
| Sample Name: | ZwoYU6sMuf.elf |
| Original Sample Name: | 8596b159b93a5dd6d904063425c554bb.elf |
| Analysis ID: | 1289016 |
| MD5: | 8596b159b93a5dd6d904063425c554bb |
| SHA1: | 038a9ecb194a1230f3085d3082bbc23d12774884 |
| SHA256: | 91299819fad0491760f199263dfaa1453d5111368573522ffbe59383181b00ff |
| Tags: | 32elfgafgytintel |
| Infos: |  |
 | |
Detection
Mirai
| Score: | 80 |
| Range: | 0 - 100 |
| Whitelisted: | false |
Signatures
Malicious sample detected (through community Yara rule)
Antivirus / Scanner detection for submitted sample
Yara detected Mirai
Multi AV Scanner detection for submitted file
Uses known network protocols on non-standard ports
Machine Learning detection for sample
Yara signature match
Deletes log files
Sample has stripped symbol table
Uses the "uname" system call to query kernel version information (possible evasion)
Executes commands using a shell command-line interpreter
Executes the "systemctl" command used for controlling the systemd system and service manager
Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)
Detected TCP or UDP traffic on non-standard ports
Classification
Analysis Advice
| All HTTP servers contacted by the sample do not answer. The sample is likely an old dropper which does no longer work. |
| Joe Sandbox Version: | 38.0.0 Beryl |
| Analysis ID: | 1289016 |
| Start date and time: | 2023-08-10 00:40:02 +02:00 |
| Joe Sandbox Product: | CloudBasic |
| Overall analysis duration: | 0h 7m 55s |
| Hypervisor based Inspection enabled: | false |
| Report type: | full |
| Cookbook file name: | defaultlinuxfilecookbook.jbs |
| Analysis system description: | Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11) |
| Analysis Mode: | default |
| Sample file name: | ZwoYU6sMuf.elf |
| Original Sample Name: | 8596b159b93a5dd6d904063425c554bb.elf |
| Detection: | MAL |
| Classification: | mal80.troj.linELF@0/53@0/0 |
- Report size exceeded maximum capacity and may have missing network information.
| Command: | /tmp/ZwoYU6sMuf.elf |
| PID: | 6298 |
| Exit Code: | |
| Exit Code Info: | |
| Killed: | True |
| Standard Output: | JEW was here lol DEBUG MODE YO [main] we are the only process on this system! [watchdog] failed to find a valid watchdog driver, bailing out DEBUG MODE YO [main] we are the only process on this system! [watchdog] failed to find a valid watchdog driver, bailing out DEBUG MODE YO [main] we are the only process on this system! [scanner] Scanner process initialized. Scanning started. [scanner] FD5 Attempting to brute found IP 92.92.26.222 [scanner] FD6 Attempting to brute found IP 92.92.41.117 [scanner] FD7 Attempting to brute found IP 60.213.188.218 [scanner] FD8 Attempting to brute found IP 112.123.26.203 [scanner] FD9 Attempting to brute found IP 131.108.156.248 [scanner] FD10 Attempting to brute found IP 181.24.145.9 [scanner] FD6 connected. Trying 14=9>:!'5"$) [scanner] FD5 connected. Trying $5<53?=14=9>:>g:ue= [scanner] FD7 connected. Trying 14=9>:817 ?<=a [scanner] FD11 Attempting to brute found IP 62.76.90.45 [scanner] FD9 connected. Trying "??$:ffffff [scanner] FD11 connected. Trying "??$:*#%>aahh [scanner] FD10 connected. Trying %2>$:%2>$ [scanner] FD11 finished telnet negotiation [scanner] FD11 received username prompt [scanner] FD7 finished telnet negotiation [scanner] FD11 received password prompt [scanner] FD9 connection gracefully closed [scanner] FD9 lost connection [scanner] FD9 retrying with different auth combo! [scanner] FD10 finished telnet negotiation [scanner] FD11 connection gracefully closed [scanner] FD11 lost connection [scanner] FD11 retrying with different auth combo! [scanner] FD11 connected. Trying #5"&935:#5"&935 [scanner] FD11 finished telnet negotiation [scanner] FD11 received username prompt [scanner] FD9 connected. Trying 7%5#$:aaaa [scanner] FD11 received password prompt [scanner] FD10 received username prompt [scanner] FD11 connection gracefully closed [scanner] FD11 lost connection [scanner] FD11 retrying with different auth combo! [scanner] FD11 connected. Trying 14=9>:4&"beh`bbb [scanner] FD9 connection gracefully closed [scanner] FD9 lost connection [scanner] FD9 retrying with different auth combo! [scanner] FD11 finished telnet negotiation [scanner] FD11 received username prompt [scanner] FD12 Attempting to brute found IP 31.200.203.137 [scanner] FD12 connected. Trying "??$:8c3 [scanner] FD11 received password prompt [scanner] FD12 connection gracefully closed [scanner] FD12 lost connection [scanner] FD12 retrying with different auth combo! [scanner] FD8 connected. Trying "??$:b`aa&#$1 [scanner] FD9 connected. Trying 14=9>:=93"?2%#9>5## [scanner] FD12 connected. Trying "??$:'9>a4?'# [scanner] FD11 connection gracefully closed [scanner] FD11 lost connection [scanner] FD11 retrying with different auth combo! [scanner] FD11 connected. Trying "??$:$<ghi [scanner] FD12 connection gracefully closed [scanner] FD12 lost connection [scanner] FD12 retrying with different auth combo! [scanner] FD8 finished telnet negotiation [scanner] FD11 finished telnet negotiation [scanner] FD11 received username prompt [scanner] FD10 received password prompt [scanner] FD9 connection gracefully closed [scanner] FD9 lost connection [scanner] FD9 retrying with different auth combo! [scanner] FD11 received password prompt [scanner] FD11 connection gracefully closed [scanner] FD11 lost connection [scanner] FD11 retrying with different auth combo! [scanner] FD11 connected. Trying "??$:hhhhhhhh [scanner] FD10 received shell prompt [scanner] FD9 connected. Trying "??$:*#%>aahh [scanner] FD11 finished telnet negotiation [scanner] FD11 received username prompt [scanner] FD8 received username prompt [scanner] FD11 received password prompt [scanner] FD9 connection gracefully closed [scanner] FD9 lost connection [scanner] FD9 retrying with different auth combo! [scanner] FD8 received password prompt [scanner] FD11 connection gracefully closed [scanner] FD11 lost connection [scanner] FD11 retrying with different auth combo! [scanner] FD11 connected. Trying "??$:%#5" [scanner] FD11 finished telnet negotiation [scanner] FD11 received username prompt [scanner] FD9 connected. Trying "??$:$'5h58?=5 [scanner] FD11 received password prompt [scanner] FD8 received shell prompt [scanner] FD8 received sh prompt [scanner] FD12 connected. Trying "??$:9 31="$ece` [scanner] FD9 connection gracefully closed [scanner] FD9 lost connection [scanner] FD9 retrying with different auth combo! [scanner] FD8 received sh prompt [scanner] FD12 connection gracefully closed [scanner] FD12 lost connection [scanner] FD12 retrying with different auth combo! [scanner] FD12 connected. Trying 14=9>:aaaaaaa [scanner] FD11 connection gracefully closed [scanner] FD11 lost connection [scanner] FD11 retrying with different auth combo! [scanner] FD11 connected. Trying %#5": 1##'?"4 [scanner] FD12 connection gracefully closed [scanner] FD12 lost connection [scanner] FD12 retrying with different auth combo! [scanner] FD9 connected. Trying "??$:%#5" [scanner] FD8 received enable prompt [scanner] FD11 finished telnet negotiation [scanner] FD11 received username prompt [scanner] FD12 connected. Trying 4561%<$:$<' 2?f [scanner] FD12 connection gracefully closed [scanner] FD12 lost connection [scanner] FD12 retrying with different auth combo! [scanner] FD11 received password prompt [scanner] FD8 received sh prompt [scanner] FD12 connected. Trying "??$:a``a389> [scanner] FD9 connection gracefully closed [scanner] FD9 lost connection [scanner] FD9 retrying with different auth combo! [scanner] FD11 connection gracefully closed [scanner] FD11 lost connection [scanner] FD11 retrying with different auth combo! [scanner] FD12 connection gracefully closed [scanner] FD12 lost connection [scanner] FD12 retrying with different auth combo! [scanner] FD11 connected. Trying "??$:%<9>%( [scanner] FD12 connected. Trying 14=9>:aaaaaaa [scanner] FD11 finished telnet negotiation [scanner] FD11 received username prompt [scanner] FD12 connection gracefully closed [scanner] FD12 lost connection [scanner] FD12 retrying with different auth combo! [scanner] FD9 connected. Trying 14=9>:&b= "$ [scanner] FD11 received password prompt [scanner] FD12 connected. Trying "??$:e`` [scanner] FD12 connection gracefully closed [scanner] FD12 lost connection [scanner] FD12 retrying with different auth combo! [scanner] FD13 Attempting to brute found IP 42.119.19.158 [scanner] FD11 connection gracefully closed [scanner] FD11 lost connection [scanner] FD11 retrying with different auth combo! [scanner] FD12 connected. Trying 14=9>:!'5"$) [scanner] FD11 connected. Trying "??$: $5eba [scanner] FD11 finished telnet negotiation [scanner] FD11 received username prompt [scanner] FD12 connection gracefully closed [scanner] FD12 lost connection [scanner] FD12 retrying with different auth combo! [scanner] FD12 connected. Trying 4561%<$:4561%<$ [scanner] FD11 received password prompt [scanner] FD12 connection gracefully closed [scanner] FD12 lost connection [scanner] FD13 connected. Trying 14=9>:'17? [scanner] FD11 connection gracefully closed [scanner] FD11 lost connection [scanner] FD11 retrying with different auth combo! [scanner] FD11 connected. Trying %#5":%#5" [scanner] FD11 finished telnet negotiation [scanner] FD11 received username prompt [scanner] FD13 connection gracefully closed [scanner] FD13 lost connection [scanner] FD12 retrying with different auth combo! [scanner] FD11 received password prompt [scanner] FD11 connection gracefully closed [scanner] FD11 lost connection [scanner] FD12 connected. Trying 14=9>:>5$751"a [scanner] FD9 connection gracefully closed [scanner] FD9 lost connection [scanner] FD9 retrying with different auth combo! [scanner] FD12 connection gracefully closed [scanner] FD12 lost connection [scanner] FD11 retrying with different auth combo! [scanner] FD9 connected. Trying "??$:*#%>aahh [scanner] FD11 connected. Trying "??$:"??$ [scanner] FD9 connection gracefully closed [scanner] FD9 lost connection [scanner] FD9 retrying with different auth combo! [scanner] FD11 connection gracefully closed [scanner] FD11 lost connection [scanner] FD11 retrying with different auth combo! [scanner] FD10 received sh prompt [scanner] FD9 connected. Trying "??$:*#%>aahh [scanner] FD11 connected. Trying 14=9>:9 31="$ece` [scanner] FD9 connection gracefully closed [scanner] FD9 lost connection [scanner] FD9 retrying with different auth combo! [scanner] FD11 connection gracefully closed [scanner] FD11 lost connection [scanner] FD11 retrying with different auth combo! [scanner] FD9 connected. Trying "??$:(3ceaa [scanner] FD9 connection gracefully closed [scanner] FD9 lost connection [scanner] FD11 connected. Trying "??$:8c3 [scanner] FD10 received sh prompt [scanner] FD8 connection gracefully closed [scanner] FD8 lost connection [scanner] FD8 retrying with different auth combo! [scanner] FD11 connection gracefully closed [scanner] FD11 lost connection [scanner] FD9 retrying with different auth combo! [scanner] FD8 connected. Trying "??$:9 3ga1 [scanner] FD11 Attempting to brute found IP 103.39.24.170 [scanner] FD12 Attempting to brute found IP 183.66.142.226 [scanner] FD9 connected. Trying "??$: 1## [scanner] FD8 finished telnet negotiation [scanner] FD11 connected. Trying "??$:14=9>=9=969 [scanner] FD12 connected. Trying "??$:*#%>aahh [scanner] FD9 connection gracefully closed [scanner] FD9 lost connection [scanner] FD9 retrying with different auth combo! [scanner] FD8 received username prompt [scanner] FD12 finished telnet negotiation [scanner] FD12 received username prompt [scanner] FD9 connected. Trying "??$:aaaa [scanner] FD8 received password prompt [scanner] FD9 connection gracefully closed [scanner] FD9 lost connection [scanner] FD9 retrying with different auth combo! [scanner] FD8 received shell prompt [scanner] FD8 received sh prompt [scanner] FD9 connected. Trying "??$:?5<9>%(abc [scanner] FD8 received sh prompt [scanner] FD8 received enable prompt [scanner] FD9 connection gracefully closed [scanner] FD9 lost connection [scanner] FD9 retrying with different auth combo! [scanner] FD8 received sh prompt [scanner] FD9 connected. Trying "??$:$9>9 [scanner] FD12 received password prompt [scanner] FD12 received shell prompt [scanner] FD9 connection gracefully closed [scanner] FD9 lost connection [scanner] FD9 retrying with different auth combo! [scanner] FD9 connected. Trying "??$:$5<53?=14=9> [scanner] FD9 connection gracefully closed [scanner] FD9 lost connection [scanner] FD12 received sh prompt [scanner] FD9 Attempting to brute found IP 206.188.83.177 [scanner] FD12 received sh prompt [scanner] FD9 connected. Trying "??$:8#<'96931= [scanner] FD10 received enable prompt [scanner] FD9 connection gracefully closed [scanner] FD9 lost connection [scanner] FD9 retrying with different auth combo! [scanner] FD9 connected. Trying "??$:7"?%$5" [scanner] FD9 connection gracefully closed [scanner] FD9 lost connection [scanner] FD9 retrying with different auth combo! [scanner] FD10 received sh prompt [scanner] FD9 connected. Trying "??$:(=849 3 [scanner] FD9 connection gracefully closed [scanner] FD9 lost connection [scanner] FD9 retrying with different auth combo! [scanner] FD9 connected. Trying "??$: [scanner] FD9 connection gracefully closed [scanner] FD9 lost connection [scanner] FD9 retrying with different auth combo! [scanner] FD10 connection gracefully closed [scanner] FD10 lost connection [scanner] FD10 retrying with different auth combo! [scanner] FD9 connected. Trying 4561%<$: [scanner] FD10 connected. Trying "??$:!'5"$) [scanner] FD9 connection gracefully closed [scanner] FD9 lost connection [scanner] FD9 retrying with different auth combo! [scanner] FD9 connected. Trying "??$:$5<53?=14=9> [scanner] FD10 finished telnet negotiation [scanner] FD8 connection gracefully closed [scanner] FD8 lost connection [scanner] FD8 retrying with different auth combo! [scanner] FD9 connection gracefully closed [scanner] FD9 lost connection [scanner] FD9 retrying with different auth combo! [scanner] FD8 connected. Trying 14=9>:!}d$c [scanner] FD10 received username prompt [scanner] FD9 connected. Trying "??$: [scanner] FD8 finished telnet negotiation [scanner] FD9 connection gracefully closed [scanner] FD9 lost connection [scanner] FD9 retrying with different auth combo! [scanner] FD9 connected. Trying "??$:$9>9 [scanner] FD10 received password prompt [scanner] FD8 received username prompt [scanner] FD9 connection gracefully closed [scanner] FD9 lost connection [scanner] FD9 retrying with different auth combo! [scanner] FD9 connected. Trying "??$:14=9> [scanner] FD13 Attempting to brute found IP 206.188.83.177 [scanner] FD8 received password prompt [scanner] FD13 connected. Trying 4561%<$:$<' 2?f [scanner] FD9 connection gracefully closed [scanner] FD9 lost connection [scanner] FD9 retrying with different auth combo! [scanner] FD9 connected. Trying "??$:$'5h58?=5 [scanner] FD8 received shell prompt [scanner] FD13 connection gracefully closed [scanner] FD13 lost connection [scanner] FD13 retrying with different auth combo! [scanner] FD8 received sh prompt [scanner] FD13 connected. Trying 14=9>:abcd [scanner] FD9 connection gracefully closed [scanner] FD9 lost connection [scanner] FD8 received sh prompt [scanner] FD13 connection gracefully closed [scanner] FD13 lost connection [scanner] FD9 retrying with different auth combo! [scanner] FD8 received enable prompt [scanner] FD9 connected. Trying "??$:$5<>5$ [scanner] FD8 received sh prompt [scanner] FD9 connection gracefully closed [scanner] FD9 lost connection [scanner] FD9 retrying with different auth combo! [scanner] FD9 connected. Trying "??$:;<&abcd [scanner] FD9 connection gracefully closed [scanner] FD9 lost connection [scanner] FD9 retrying with different auth combo! [scanner] FD9 connected. Trying "??$:b``h`hbf [scanner] FD9 connection gracefully closed [scanner] FD9 lost connection [scanner] FD9 retrying with different auth combo! [scanner] FD12 received enable prompt [scanner] FD9 connected. Trying "??$:#&7?495 [scanner] FD9 connection gracefully closed [scanner] FD9 lost connection [scanner] FD9 retrying with different auth combo! [scanner] FD9 connected. Trying 14=9>:9 31="$ece` [scanner] FD9 connection gracefully closed [scanner] FD9 lost connection [scanner] FD9 retrying with different auth combo! [scanner] FD12 received sh prompt [scanner] FD9 connected. Trying "??$::&2*4 [scanner] FD13 Attempting to brute found IP 151.59.117.31 [scanner] FD13 connected. Trying &#$1"31=b`ae:b`ae`f`b [scanner] FD13 connection gracefully closed [scanner] FD13 lost connection [scanner] FD13 retrying with different auth combo! [scanner] FD13 connected. Trying $5<>5$14=9>:$5<>5$14=9> [scanner] FD9 connection gracefully closed [scanner] FD9 lost connection [scanner] FD9 retrying with different auth combo! [scanner] FD13 connection gracefully closed [scanner] FD13 lost connection [scanner] FD13 retrying with different auth combo! [scanner] FD13 connected. Trying "??$:>5'#855> [scanner] FD9 connected. Trying "??$:g%:;?`"??$ [scanner] FD13 connection gracefully closed [scanner] FD13 lost connection [scanner] FD13 retrying with different auth combo! [scanner] FD13 connected. Trying "??$:!'5"$)%9? [scanner] FD13 connection gracefully closed [scanner] FD13 lost connection [scanner] FD13 retrying with different auth combo! [scanner] FD9 connection gracefully closed [scanner] FD9 lost connection [scanner] FD9 retrying with different auth combo! [scanner] FD10 received shell prompt [scanner] FD13 connected. Trying 14=9>:14=9> [scanner] FD9 connected. Trying 14=9>:3?=3?=3?= [scanner] FD13 connection gracefully closed [scanner] FD13 lost connection [scanner] FD13 retrying with different auth combo! [scanner] FD13 connected. Trying "??$:7"?%$5" [scanner] FD14 Attempting to brute found IP 134.220.15.75 [scanner] FD15 Attempting to brute found IP 78.116.41.66 [scanner] FD15 connected. Trying "??$:1< 9>5 [scanner] FD14 connected. Trying 7%5#$:7%5#$ [scanner] FD13 connection gracefully closed [scanner] FD13 lost connection [scanner] FD13 retrying with different auth combo! [scanner] FD13 connected. Trying "??$: 1## [scanner] FD9 connection gracefully closed [scanner] FD9 lost connection [scanner] FD13 connection gracefully closed [scanner] FD13 lost connection [scanner] FD9 retrying with different auth combo! [scanner] FD9 connected. Trying 14=9>:g%:;?`14=9> [scanner] FD10 received sh prompt [scanner] FD9 connection gracefully closed [scanner] FD9 lost connection [scanner] FD9 retrying with different auth combo! [scanner] FD9 connected. Trying "??$:"??$ [scanner] FD9 connection gracefully closed [scanner] FD9 lost connection [scanner] FD9 retrying with different auth combo! [scanner] FD8 connection gracefully closed [scanner] FD8 lost connection [scanner] FD8 retrying with different auth combo! [scanner] FD9 connected. Trying "??$:!'5"$) [scanner] FD9 connection gracefully closed [scanner] FD9 lost connection [scanner] FD8 connected. Trying "??$:31=a`bi [scanner] FD8 finished telnet negotiation [scanner] FD9 Attempting to brute found IP 221.213.44.28 [scanner] FD13 Attempting to brute found IP 196.31.41.169 [scanner] FD16 Attempting to brute found IP 61.245.180.30 [scanner] FD8 received username prompt [scanner] FD9 connected. Trying 7%5#$:abcd [scanner] FD8 received password prompt [scanner] FD13 connected. Trying "??$:#'#2*;7> [scanner] FD16 connected. Trying "??$:g%:;?`"??$ [scanner] FD9 finished telnet negotiation [scanner] FD13 finished telnet negotiation [scanner] FD13 received username prompt [scanner] FD8 received shell prompt [scanner] FD16 finished telnet negotiation [scanner] FD9 received username prompt [scanner] FD8 received sh prompt [scanner] FD8 received sh prompt [scanner] FD16 received username prompt [scanner] FD9 received password prompt [scanner] FD8 received enable prompt [scanner] FD9 received shell prompt [scanner] FD8 received sh prompt [scanner] FD13 received password prompt [scanner] FD16 received password prompt [scanner] FD10 received sh prompt [scanner] FD17 Attempting to brute found IP 34.111.59.151 [scanner] FD17 connected. Trying "??$:abc [scanner] FD17 connection gracefully closed [scanner] FD17 lost connection [scanner] FD17 retrying with different auth combo! [scanner] FD17 connected. Trying 7%5#$:abcde [scanner] FD17 connection gracefully closed [scanner] FD17 lost connection [scanner] FD17 retrying with different auth combo! [scanner] FD17 connected. Trying "??$:8%97%c`i [scanner] FD17 connection gracefully closed [scanner] FD17 lost connection [scanner] FD17 retrying with different auth combo! [scanner] FD17 connected. Trying "??$:$1 *`a [scanner] FD17 connection gracefully closed [scanner] FD17 lost connection [scanner] FD17 retrying with different auth combo! [scanner] FD17 connected. Trying 14=9>:14=9> [scanner] FD17 connection gracefully closed [scanner] FD17 lost connection [scanner] FD17 retrying with different auth combo! [scanner] FD17 connected. Trying "??$:8%>$egei [scanner] FD17 connection gracefully closed [scanner] FD17 lost connection [scanner] FD17 retrying with different auth combo! [scanner] FD17 connected. Trying 452%7:452%7abd [scanner] FD17 connection gracefully closed [scanner] FD17 lost connection [scanner] FD17 retrying with different auth combo! [scanner] FD17 connected. Trying %2>$:%2>$ [scanner] FD17 connection gracefully closed [scanner] FD17 lost connection [scanner] FD17 retrying with different auth combo! [scanner] FD17 connected. Trying "??$: "9&1$5 [scanner] FD17 connection gracefully closed [scanner] FD17 lost connection [scanner] FD17 retrying with different auth combo! [scanner] FD17 connected. Trying 14=9>:6<9"14=9> [scanner] FD17 connection gracefully closed [scanner] FD17 lost connection [scanner] FD10 received enable prompt [scanner] FD10 received sh prompt [scanner] FD10 connection gracefully closed [scanner] FD10 lost connection [scanner] FD10 retrying with different auth combo! [scanner] FD8 connection gracefully closed [scanner] FD8 lost connection [scanner] FD8 retrying with different auth combo! [scanner] FD8 connected. Trying "??$:#&7?495 [scanner] FD9 received sh prompt [scanner] FD8 finished telnet negotiation [scanner] FD17 Attempting to brute found IP 223.100.227.129 [scanner] FD16 received shell prompt [scanner] FD9 received sh prompt [scanner] FD8 received username prompt [scanner] FD10 connected. Trying "??$:*$5i(ae [scanner] FD17 connected. Trying "??$:389>1abc [scanner] FD8 received password prompt [scanner] FD10 finished telnet negotiation [scanner] FD17 finished telnet negotiation [scanner] FD18 Attempting to brute found IP 41.227.63.61 [scanner] FD17 received username prompt [scanner] FD18 connected. Trying 7%5#$:7%5#$ [scanner] FD19 Attempting to brute found IP 156.250.95.13 [scanner] FD16 received sh prompt [scanner] FD10 received username prompt [scanner] FD20 Attempting to brute found IP 43.254.151.207 [scanner] FD8 received shell prompt [scanner] FD18 connection gracefully closed [scanner] FD18 lost connection [scanner] FD18 retrying with different auth combo! [scanner] FD8 received sh prompt [scanner] FD19 connected. Trying "??$::%1>$538 [scanner] FD18 connected. Trying "??$:```````` [scanner] FD18 connection gracefully closed [scanner] FD18 lost connection [scanner] FD18 retrying with different auth combo! [scanner] FD18 connected. Trying 14=9>:19"<9&5 [scanner] FD10 received password prompt [scanner] FD8 received sh prompt [scanner] FD20 connected. Trying 415=?>:415=?> [scanner] FD19 connection gracefully closed [scanner] FD19 lost connection [scanner] FD19 retrying with different auth combo! [scanner] FD18 connection gracefully closed [scanner] FD18 lost connection [scanner] FD18 retrying with different auth combo! [scanner] FD17 received password prompt [scanner] FD18 connected. Trying "??$:$1 *bcdiehei [scanner] FD13 received shell prompt [scanner] FD8 received enable prompt [scanner] FD18 connection gracefully closed [scanner] FD18 lost connection [scanner] FD18 retrying with different auth combo! [scanner] FD19 connected. Trying "??$:87b(` [scanner] FD18 connected. Trying 14=9>:!}d$c [scanner] FD18 connection gracefully closed [scanner] FD18 lost connection [scanner] FD18 retrying with different auth combo! [scanner] FD8 received sh prompt [scanner] FD18 connected. Trying "??$:>6<53$9?> [scanner] FD21 Attempting to brute found IP 31.44.131.214 [scanner] FD19 connection gracefully closed [scanner] FD19 lost connection [scanner] FD19 retrying with different auth combo! [scanner] FD18 connection gracefully closed [scanner] FD18 lost connection [scanner] FD18 retrying with different auth combo! [scanner] FD21 connected. Trying 7%5#$:7%5#$ [scanner] FD18 connected. Trying %#5": 1##'?"4 [scanner] FD17 received shell prompt [scanner] FD19 connected. Trying =7ce``:=5"<9> [scanner] FD22 Attempting to brute found IP 177.20.236.176 [scanner] FD18 connection gracefully closed [scanner] FD18 lost connection [scanner] FD18 retrying with different auth combo! [scanner] FD18 connected. Trying 7%5#$:aaaa [scanner] FD18 connection gracefully closed [scanner] FD18 lost connection [scanner] FD18 retrying with different auth combo! [scanner] FD19 connection gracefully closed [scanner] FD19 lost connection [scanner] FD19 retrying with different auth combo! [scanner] FD18 connected. Trying $5<>5$:$5<>5$ [scanner] FD22 connected. Trying "??$: 1## [scanner] FD18 connection gracefully closed [scanner] FD18 lost connection [scanner] FD18 retrying with different auth combo! [scanner] FD18 connected. Trying 14=9>:aaaaaaa [scanner] FD19 connected. Trying 29>: [scanner] FD18 connection gracefully closed [scanner] FD18 lost connection [scanner] FD22 finished telnet negotiation [scanner] FD22 received username prompt [scanner] FD17 received sh prompt [scanner] FD19 connection gracefully closed [scanner] FD19 lost connection [scanner] FD18 retrying with different auth combo! [scanner] FD18 connected. Trying "??$:8%97%c`i [scanner] FD22 received password prompt [scanner] FD17 received sh prompt [scanner] FD18 connection gracefully closed [scanner] FD18 lost connection [scanner] FD18 retrying with different auth combo! [scanner] FD22 received shell prompt [scanner] FD18 connected. Trying 7%5#$:7%5#$ [scanner] FD22 received sh prompt [scanner] FD18 connection gracefully closed [scanner] FD18 lost connection [scanner] FD18 retrying with different auth combo! [scanner] FD17 received enable prompt [scanner] FD18 connected. Trying %#5": 1##'?"4 [scanner] FD22 received sh prompt [scanner] FD9 received enable prompt [scanner] FD19 Attempting to brute found IP 156.250.95.13 [scanner] FD18 connection gracefully closed [scanner] FD18 lost connection [scanner] FD18 retrying with different auth combo! [scanner] FD22 received enable prompt [scanner] FD19 connected. Trying 7%5#$:abcde [scanner] FD18 connected. Trying "??$:8%97%c`i [scanner] FD19 connection gracefully closed [scanner] FD19 lost connection [scanner] FD19 retrying with different auth combo! [scanner] FD18 connection gracefully closed [scanner] FD18 lost connection [scanner] FD18 retrying with different auth combo! [scanner] FD9 received sh prompt [scanner] FD22 received sh prompt [scanner] FD16 received sh prompt [scanner] FD19 connected. Trying 5*4&":5*4&" [scanner] FD18 connected. Trying 14=9>:381>75=5 [scanner] FD19 connection gracefully closed [scanner] FD19 lost connection [scanner] FD19 retrying with different auth combo! [scanner] FD22 invalid username/password combo [scanner] FD22 retrying with different auth combo! [scanner] FD18 connection gracefully closed [scanner] FD18 lost connection [scanner] FD18 retrying with different auth combo! [scanner] FD10 received shell prompt [scanner] FD8 connection gracefully closed [scanner] FD8 lost connection [scanner] FD8 retrying with different auth combo! [scanner] FD18 connected. Trying "??$:&5"$5(be5;$;#abc [scanner] FD8 connected. Trying 14=9>:1!%1"9? [scanner] FD16 received enable prompt [scanner] FD18 connection gracefully closed [scanner] FD18 lost connection [scanner] FD8 finished telnet negotiation [scanner] FD17 connection gracefully closed [scanner] FD17 lost connection [scanner] FD17 retrying with different auth combo! [scanner] FD10 received sh prompt [scanner] FD8 received username prompt [scanner] FD17 connected. Trying "??$:$1 *`a [scanner] FD8 received password prompt [scanner] FD17 finished telnet negotiation [scanner] FD17 received username prompt [scanner] FD19 connected. Trying "??$:&5"$5(be5;$;#abc [scanner] FD22 connected. Trying "??$:$5<53?=14=9> [scanner] FD8 received shell prompt [scanner] FD8 received sh prompt [scanner] FD19 connection gracefully closed [scanner] FD19 lost connection [scanner] FD18 retrying with different auth combo! [scanner] FD22 finished telnet negotiation [scanner] FD22 received username prompt [scanner] FD8 received sh prompt [scanner] FD18 connected. Trying "??$:89;&9#9?> [scanner] FD17 received password prompt [scanner] FD8 received enable prompt [scanner] FD18 connection gracefully closed [scanner] FD18 lost connection [scanner] FD18 retrying with different auth combo! [scanner] FD8 received sh prompt [scanner] FD22 received password prompt [scanner] FD17 received shell prompt [scanner] FD22 received shell prompt [scanner] FD17 received sh prompt [scanner] FD22 received sh prompt [scanner] FD17 received sh prompt [scanner] FD22 received sh prompt [scanner] FD17 received enable prompt [scanner] FD22 received enable prompt [scanner] FD5 timed out (state = 2) [scanner] FD6 timed out (state = 2) [scanner] FD18 connected. Trying 415=?>:415=?> [scanner] FD5 Attempting to brute found IP 197.15.45.219 [scanner] FD17 received sh prompt [scanner] FD22 received sh prompt [scanner] FD9 invalid username/password combo [scanner] FD6 retrying with different auth combo! [scanner] FD5 connected. Trying "??$:4&" [scanner] FD9 Attempting to brute found IP 218.239.223.4 [scanner] FD18 connection gracefully closed [scanner] FD18 lost connection [scanner] FD18 retrying with different auth combo! [scanner] FD5 connection gracefully closed [scanner] FD5 lost connection [scanner] FD5 retrying with different auth combo! [scanner] FD22 invalid username/password combo [scanner] FD19 retrying with different auth combo! [scanner] FD6 connected. Trying "??$::&2*4 [scanner] FD5 connected. Trying 14=9>:6<9"14=9> [scanner] FD18 connected. Trying "??$:381>75=5 [scanner] FD5 connection gracefully closed [scanner] FD5 lost connection [scanner] FD5 retrying with different auth combo! [scanner] FD9 connected. Trying "??$::%1>$538 [scanner] FD6 finished telnet negotiation [scanner] FD19 connected. Trying 14=9>:abcde [scanner] FD5 connected. Trying "??$:#?<?;5) [scanner] FD5 connection gracefully closed [scanner] FD5 lost connection [scanner] FD5 retrying with different auth combo! [scanner] FD18 connection gracefully closed [scanner] FD18 lost connection [scanner] FD18 retrying with different auth combo! [scanner] FD5 connected. Trying "??$:2<5>45" [scanner] FD6 received username prompt [scanner] FD19 finished telnet negotiation [scanner] FD19 received username prompt [scanner] FD7 timed out (state = 3) [scanner] FD7 retrying with different auth combo! [scanner] FD5 connection gracefully closed [scanner] FD5 lost connection [scanner] FD5 retrying with different auth combo! [scanner] FD22 Attempting to brute found IP 172.65.20.74 [scanner] FD23 Attempting to brute found IP 134.220.253.152 [scanner] FD22 connected. Trying 14=9>:4&"beh`bbb [scanner] FD23 connected. Trying 14=9>:5 93"?%$5" [scanner] FD22 lost connection [scanner] FD22 retrying with different auth combo! [scanner] FD18 connected. Trying 452%7:452%7abd [scanner] FD22 connected. Trying $5<>5$14=9>:$5<>5$14=9> [scanner] FD22 lost connection [scanner] FD22 retrying with different auth combo! [scanner] FD16 connection gracefully closed [scanner] FD16 lost connection [scanner] FD16 retrying with different auth combo! [scanner] FD22 connected. Trying $5<>5$14=9>:$5<>5$14=9> [scanner] FD5 connected. Trying 7%5#$:7%5#$ [scanner] FD22 lost connection [scanner] FD22 retrying with different auth combo! [scanner] FD22 connected. Trying "??$:ffffff [scanner] FD7 connected. Trying 4561%<$:&b= "$ [scanner] FD22 lost connection [scanner] FD22 retrying with different auth combo! [scanner] FD22 connected. Trying "??$:#?<?;5) [scanner] FD22 lost connection [scanner] FD22 retrying with different auth combo! [scanner] FD22 connected. Trying "??$:"51<$5; [scanner] FD5 connection gracefully closed [scanner] FD5 lost connection [scanner] FD5 retrying with different auth combo! [scanner] FD22 lost connection [scanner] FD22 retrying with different auth combo! [scanner] FD22 connected. Trying 14=9>:>5$751"a [scanner] FD22 lost connection [scanner] FD22 retrying with different auth combo! [scanner] FD22 connected. Trying "??$:;<&abc [scanner] FD10 received sh prompt [scanner] FD18 connection gracefully closed [scanner] FD18 lost connection [scanner] FD18 retrying with different auth combo! [scanner] FD22 lost connection [scanner] FD22 retrying with different auth combo! [scanner] FD5 connected. Trying 14=9>:14=9> [scanner] FD7 finished telnet negotiation [scanner] FD22 connected. Trying "??$:(3ceaa [scanner] FD22 lost connection [scanner] FD22 retrying with different auth combo! [scanner] FD22 connected. Trying 14=9>:'5#$`45= [scanner] FD22 lost connection [scanner] FD6 received password prompt [scanner] FD16 connected. Trying %#5": 1##'?"4 [scanner] FD5 connection gracefully closed [scanner] FD5 lost connection [scanner] FD5 retrying with different auth combo! [scanner] FD19 received password prompt [scanner] FD5 connected. Trying #5"&935:#5"&935 [scanner] FD18 connected. Trying %#5": 1##'?"4 [scanner] FD5 connection gracefully closed [scanner] FD5 lost connection [scanner] FD5 retrying with different auth combo! [scanner] FD6 received shell prompt [scanner] FD16 finished telnet negotiation [scanner] FD19 received shell prompt [scanner] FD5 connected. Trying 7%5#$:aaaa [scanner] FD17 connection gracefully closed [scanner] FD17 lost connection [scanner] FD17 retrying with different auth combo! [scanner] FD18 connection gracefully closed [scanner] FD18 lost connection [scanner] FD18 retrying with different auth combo! [scanner] FD5 connection gracefully closed [scanner] FD5 lost connection [scanner] FD5 retrying with different auth combo! [scanner] FD10 received enable prompt [scanner] FD5 connected. Trying "??$:14=9> [scanner] FD18 connected. Trying "??$:hahb [scanner] FD16 received username prompt [scanner] FD5 connection gracefully closed [scanner] FD5 lost connection [scanner] FD5 retrying with different auth combo! [scanner] FD17 connected. Trying 5*4&":5*4&" [scanner] FD5 connected. Trying "??$:1< 9>5 [scanner] FD18 connection gracefully closed [scanner] FD18 lost connection [scanner] FD18 retrying with different auth combo! [scanner] FD5 connection gracefully closed [scanner] FD5 lost connection [scanner] FD5 Attempting to brute found IP 156.250.95.13 [scanner] FD8 connection gracefully closed [scanner] FD8 lost connection [scanner] FD8 retrying with different auth combo! [scanner] FD19 received sh prompt [scanner] FD17 finished telnet negotiation [scanner] FD17 received username prompt [scanner] FD18 connected. Trying "??$:$5<53?=14=9> [scanner] FD5 connected. Trying "??$:```````` [scanner] FD8 connected. Trying "??$:%#5" [scanner] FD10 received sh prompt [scanner] FD10 connection gracefully closed [scanner] FD10 lost connection [scanner] FD10 retrying with different auth combo! [scanner] FD16 received password prompt [scanner] FD8 finished telnet negotiation [scanner] FD18 connection gracefully closed [scanner] FD18 lost connection [scanner] FD5 connection gracefully closed [scanner] FD5 lost connection [scanner] FD5 retrying with different auth combo! [scanner] FD10 connected. Trying "??$:1#35>4 [scanner] FD5 connected. Trying "??$:%#5" [scanner] FD17 received password prompt [scanner] FD19 received sh prompt [scanner] FD10 finished telnet negotiation [scanner] FD8 received username prompt [scanner] FD5 connection gracefully closed [scanner] FD5 lost connection [scanner] FD5 retrying with different auth combo! [scanner] FD8 received password prompt [scanner] FD18 Attempting to brute found IP 154.23.133.214 [scanner] FD10 received username prompt [scanner] FD5 connected. Trying 14=9>:bbbbb [scanner] FD17 received shell prompt [scanner] FD5 connection gracefully closed [scanner] FD5 lost connection [scanner] FD5 retrying with different auth combo! [scanner] FD8 received shell prompt [scanner] FD8 received sh prompt [scanner] FD19 received enable prompt [scanner] FD5 connected. Trying "??$:185$*9 h [scanner] FD8 received sh prompt [scanner] FD5 connection gracefully closed [scanner] FD5 lost connection [scanner] FD5 retrying with different auth combo! [scanner] FD17 received sh prompt [scanner] FD8 received enable prompt [scanner] FD5 connected. Trying "??$:8#<'96931= [scanner] FD22 Attempting to brute found IP 165.3.19.39 [scanner] FD24 Attempting to brute found IP 182.113.45.86 [scanner] FD8 received sh prompt [scanner] FD22 connected. Trying "??$:ac88 [scanner] FD5 connection gracefully closed [scanner] FD5 lost connection [scanner] FD5 retrying with different auth combo! [scanner] FD13 received sh prompt [scanner] FD24 connected. Trying "??$:381>75=5 [scanner] FD19 received sh prompt [scanner] FD18 connected. Trying "??$:b`aa&#$1 [scanner] FD17 received sh prompt [scanner] FD5 connected. Trying "??$:$9>9 [scanner] FD24 finished telnet negotiation [scanner] FD10 received password prompt [scanner] FD24 received username prompt [scanner] FD5 connection gracefully closed [scanner] FD5 lost connection [scanner] FD5 retrying with different auth combo! [scanner] FD10 received shell prompt [scanner] FD19 invalid username/password combo [scanner] FD19 retrying with different auth combo! [scanner] FD5 connected. Trying "??$:1< 9>5 [scanner] FD24 received password prompt [scanner] FD6 received sh prompt [scanner] FD13 received sh prompt [scanner] FD17 received enable prompt [scanner] FD19 connected. Trying "??$:e`` [scanner] FD13 lost connection [scanner] FD13 retrying with different auth combo! [scanner] FD5 connection gracefully closed [scanner] FD5 lost connection [scanner] FD5 retrying with different auth combo! [scanner] FD24 received shell prompt [scanner] FD19 finished telnet negotiation [scanner] FD19 received username prompt [scanner] FD13 connected. Trying "??$:ffffff [scanner] FD5 connected. Trying "??$: "9&1$5 [scanner] FD5 connection gracefully closed [scanner] FD5 lost connection [scanner] FD5 retrying with different auth combo! [scanner] FD24 received sh prompt [scanner] FD13 lost connection [scanner] FD13 retrying with different auth combo! [scanner] FD6 received sh prompt [scanner] FD5 connected. Trying "??$:8c3 [scanner] FD19 received password prompt [scanner] FD13 connected. Trying "??$: [scanner] FD5 connection gracefully closed [scanner] FD5 lost connection [scanner] FD5 retrying with different auth combo! [scanner] FD19 received shell prompt [scanner] FD24 received sh prompt [scanner] FD16 received shell prompt |
| Standard Error: |
- system is lnxubuntu20
- systemd New Fork (PID: 6200, Parent: 1)
- logrotate New Fork (PID: 6261, Parent: 6200)
- logrotate New Fork (PID: 6262, Parent: 6200)
- sh New Fork (PID: 6263, Parent: 6262)
- invoke-rc.d New Fork (PID: 6264, Parent: 6263)
- invoke-rc.d New Fork (PID: 6265, Parent: 6263)
- invoke-rc.d New Fork (PID: 6266, Parent: 6263)
- invoke-rc.d New Fork (PID: 6268, Parent: 6263)
- logrotate New Fork (PID: 6269, Parent: 6200)
- logrotate New Fork (PID: 6272, Parent: 6200)
- sh New Fork (PID: 6273, Parent: 6272)
- rsyslog-rotate New Fork (PID: 6274, Parent: 6273)
- systemd New Fork (PID: 6201, Parent: 1)
- systemd New Fork (PID: 6260, Parent: 1)
- systemd New Fork (PID: 6267, Parent: 1)
- ZwoYU6sMuf.elf New Fork (PID: 6299, Parent: 6298)
- ZwoYU6sMuf.elf New Fork (PID: 6300, Parent: 6298)
- ZwoYU6sMuf.elf New Fork (PID: 6301, Parent: 6298)
- cleanup
| Name | Description | Attribution | Blogpost URLs | Link |
|---|---|---|---|---|
| Mirai | Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world. | No Attribution |
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| Linux_Trojan_Mirai_b14f4c5d | unknown | unknown |
| |
| Linux_Trojan_Mirai_88de437f | unknown | unknown |
| |
| Linux_Trojan_Mirai_ae9d0fa6 | unknown | unknown |
| |
| Linux_Trojan_Mirai_389ee3e9 | unknown | unknown |
| |
| Linux_Trojan_Mirai_cc93863b | unknown | unknown |
| |
| Click to see the 1 entries | ||||
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| JoeSecurity_Mirai_12 | Yara detected Mirai | Joe Security |
| Source | Rule | Description | Author | Strings |
|---|---|---|---|---|
| Linux_Trojan_Mirai_b14f4c5d | unknown | unknown |
| |
| Linux_Trojan_Mirai_88de437f | unknown | unknown |
| |
| Linux_Trojan_Mirai_ae9d0fa6 | unknown | unknown |
| |
| Linux_Trojan_Mirai_389ee3e9 | unknown | unknown |
| |
| Linux_Trojan_Mirai_cc93863b | unknown | unknown |
| |
| Click to see the 13 entries | ||||
⊘No Snort rule has matched
Click to jump to signature section
Show All Signature Results
AV Detection |   |
|---|
| Source: | Avira: | ||
| Source: | Virustotal: | Perma Link | ||
| Source: | ReversingLabs: | |||
| Source: | Joe Sandbox ML: | ||
Networking | |
|---|
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | TCP traffic: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
| Source: | TCP traffic detected without corresponding DNS query: | ||
System Summary | |
|---|
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | Matched rule: | ||
| Source: | .symtab present: | ||
| Source: | Classification label: | ||
| Source: | Shell command executed: | Jump to behavior | ||
| Source: | Shell command executed: | Jump to behavior | ||
| Source: | Systemctl executable: | Jump to behavior | ||
| Source: | Systemctl executable: | Jump to behavior | ||
| Source: | Systemctl executable: | Jump to behavior | ||
Hooking and other Techniques for Hiding and Protection | |
|---|
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Network traffic detected: | ||
| Source: | Truncated file: | Jump to behavior | ||
| Source: | Truncated file: | Jump to behavior | ||
| Source: | Queries kernel information via 'uname': | Jump to behavior | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||
| Source: | Binary or memory string: | ||