Source: unknown | TCP traffic detected without corresponding DNS query: 194.180.49.236 |
Source: unknown | TCP traffic detected without corresponding DNS query: 171.80.123.109 |
Source: unknown | TCP traffic detected without corresponding DNS query: 124.242.18.115 |
Source: unknown | TCP traffic detected without corresponding DNS query: 107.78.1.13 |
Source: unknown | TCP traffic detected without corresponding DNS query: 125.237.38.10 |
Source: unknown | TCP traffic detected without corresponding DNS query: 66.133.15.74 |
Source: unknown | TCP traffic detected without corresponding DNS query: 201.6.233.176 |
Source: unknown | TCP traffic detected without corresponding DNS query: 222.75.180.245 |
Source: unknown | TCP traffic detected without corresponding DNS query: 219.188.67.15 |
Source: unknown | TCP traffic detected without corresponding DNS query: 162.137.105.178 |
Source: unknown | TCP traffic detected without corresponding DNS query: 46.137.71.27 |
Source: unknown | TCP traffic detected without corresponding DNS query: 8.189.148.193 |
Source: unknown | TCP traffic detected without corresponding DNS query: 108.18.45.241 |
Source: unknown | TCP traffic detected without corresponding DNS query: 45.116.72.36 |
Source: unknown | TCP traffic detected without corresponding DNS query: 165.81.135.217 |
Source: unknown | TCP traffic detected without corresponding DNS query: 191.62.38.201 |
Source: unknown | TCP traffic detected without corresponding DNS query: 42.187.201.102 |
Source: unknown | TCP traffic detected without corresponding DNS query: 42.119.223.198 |
Source: unknown | TCP traffic detected without corresponding DNS query: 221.82.102.24 |
Source: unknown | TCP traffic detected without corresponding DNS query: 58.195.152.14 |
Source: unknown | TCP traffic detected without corresponding DNS query: 35.58.44.105 |
Source: unknown | TCP traffic detected without corresponding DNS query: 102.148.45.243 |
Source: unknown | TCP traffic detected without corresponding DNS query: 76.99.82.48 |
Source: unknown | TCP traffic detected without corresponding DNS query: 177.231.26.96 |
Source: unknown | TCP traffic detected without corresponding DNS query: 248.16.156.206 |
Source: unknown | TCP traffic detected without corresponding DNS query: 115.212.237.140 |
Source: unknown | TCP traffic detected without corresponding DNS query: 177.113.123.241 |
Source: unknown | TCP traffic detected without corresponding DNS query: 70.205.136.8 |
Source: unknown | TCP traffic detected without corresponding DNS query: 87.118.68.20 |
Source: unknown | TCP traffic detected without corresponding DNS query: 167.79.190.116 |
Source: unknown | TCP traffic detected without corresponding DNS query: 103.143.49.144 |
Source: unknown | TCP traffic detected without corresponding DNS query: 78.33.116.190 |
Source: unknown | TCP traffic detected without corresponding DNS query: 74.84.82.18 |
Source: unknown | TCP traffic detected without corresponding DNS query: 243.241.12.185 |
Source: unknown | TCP traffic detected without corresponding DNS query: 98.17.14.175 |
Source: unknown | TCP traffic detected without corresponding DNS query: 217.44.66.3 |
Source: unknown | TCP traffic detected without corresponding DNS query: 94.32.160.50 |
Source: unknown | TCP traffic detected without corresponding DNS query: 149.51.184.4 |
Source: unknown | TCP traffic detected without corresponding DNS query: 18.25.14.57 |
Source: unknown | TCP traffic detected without corresponding DNS query: 19.121.40.241 |
Source: unknown | TCP traffic detected without corresponding DNS query: 196.9.239.237 |
Source: unknown | TCP traffic detected without corresponding DNS query: 1.218.227.55 |
Source: unknown | TCP traffic detected without corresponding DNS query: 43.64.19.252 |
Source: unknown | TCP traffic detected without corresponding DNS query: 250.109.144.85 |
Source: unknown | TCP traffic detected without corresponding DNS query: 218.96.55.49 |
Source: unknown | TCP traffic detected without corresponding DNS query: 46.20.33.251 |
Source: unknown | TCP traffic detected without corresponding DNS query: 159.5.196.98 |
Source: unknown | TCP traffic detected without corresponding DNS query: 66.182.255.152 |
Source: unknown | TCP traffic detected without corresponding DNS query: 252.220.164.138 |
Source: unknown | TCP traffic detected without corresponding DNS query: 43.115.96.240 |
Source: u0bsYQWyNZ.elf, type: SAMPLE | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown |
Source: u0bsYQWyNZ.elf, type: SAMPLE | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown |
Source: 5677.1.00007f7fcc001000.00007f7fcc011000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown |
Source: 5677.1.00007f7fcc001000.00007f7fcc011000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown |
Source: 5564.1.00007f7fcc001000.00007f7fcc011000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown |
Source: 5564.1.00007f7fcc001000.00007f7fcc011000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown |
Source: 5563.1.00007f7fcc001000.00007f7fcc011000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown |
Source: 5563.1.00007f7fcc001000.00007f7fcc011000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown |
Source: 5570.1.00007f7fcc001000.00007f7fcc011000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown |
Source: 5570.1.00007f7fcc001000.00007f7fcc011000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown |
Source: 5668.1.00007f7fcc001000.00007f7fcc011000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown |
Source: 5668.1.00007f7fcc001000.00007f7fcc011000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown |
Source: 5561.1.00007f7fcc001000.00007f7fcc011000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown |
Source: 5561.1.00007f7fcc001000.00007f7fcc011000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown |
Source: 5660.1.00007f7fcc001000.00007f7fcc011000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown |
Source: 5660.1.00007f7fcc001000.00007f7fcc011000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown |
Source: 5665.1.00007f7fcc001000.00007f7fcc011000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown |
Source: 5665.1.00007f7fcc001000.00007f7fcc011000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown |
Source: Process Memory Space: u0bsYQWyNZ.elf PID: 5561, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown |
Source: Process Memory Space: u0bsYQWyNZ.elf PID: 5561, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown |
Source: Process Memory Space: u0bsYQWyNZ.elf PID: 5563, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown |
Source: Process Memory Space: u0bsYQWyNZ.elf PID: 5563, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown |
Source: Process Memory Space: u0bsYQWyNZ.elf PID: 5564, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown |
Source: Process Memory Space: u0bsYQWyNZ.elf PID: 5564, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown |
Source: Process Memory Space: u0bsYQWyNZ.elf PID: 5570, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown |
Source: Process Memory Space: u0bsYQWyNZ.elf PID: 5570, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown |
Source: Process Memory Space: u0bsYQWyNZ.elf PID: 5660, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown |
Source: Process Memory Space: u0bsYQWyNZ.elf PID: 5660, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown |
Source: Process Memory Space: u0bsYQWyNZ.elf PID: 5668, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown |
Source: Process Memory Space: u0bsYQWyNZ.elf PID: 5668, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown |
Source: Process Memory Space: u0bsYQWyNZ.elf PID: 5677, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown |
Source: Process Memory Space: u0bsYQWyNZ.elf PID: 5677, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 Author: unknown |
Source: u0bsYQWyNZ.elf, type: SAMPLE | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: u0bsYQWyNZ.elf, type: SAMPLE | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16 |
Source: 5677.1.00007f7fcc001000.00007f7fcc011000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: 5677.1.00007f7fcc001000.00007f7fcc011000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16 |
Source: 5564.1.00007f7fcc001000.00007f7fcc011000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: 5564.1.00007f7fcc001000.00007f7fcc011000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16 |
Source: 5563.1.00007f7fcc001000.00007f7fcc011000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: 5563.1.00007f7fcc001000.00007f7fcc011000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16 |
Source: 5570.1.00007f7fcc001000.00007f7fcc011000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: 5570.1.00007f7fcc001000.00007f7fcc011000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16 |
Source: 5668.1.00007f7fcc001000.00007f7fcc011000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: 5668.1.00007f7fcc001000.00007f7fcc011000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16 |
Source: 5561.1.00007f7fcc001000.00007f7fcc011000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: 5561.1.00007f7fcc001000.00007f7fcc011000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16 |
Source: 5660.1.00007f7fcc001000.00007f7fcc011000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: 5660.1.00007f7fcc001000.00007f7fcc011000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16 |
Source: 5665.1.00007f7fcc001000.00007f7fcc011000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: 5665.1.00007f7fcc001000.00007f7fcc011000.r-x.sdmp, type: MEMORY | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16 |
Source: Process Memory Space: u0bsYQWyNZ.elf PID: 5561, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: Process Memory Space: u0bsYQWyNZ.elf PID: 5561, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16 |
Source: Process Memory Space: u0bsYQWyNZ.elf PID: 5563, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: Process Memory Space: u0bsYQWyNZ.elf PID: 5563, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16 |
Source: Process Memory Space: u0bsYQWyNZ.elf PID: 5564, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: Process Memory Space: u0bsYQWyNZ.elf PID: 5564, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16 |
Source: Process Memory Space: u0bsYQWyNZ.elf PID: 5570, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: Process Memory Space: u0bsYQWyNZ.elf PID: 5570, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16 |
Source: Process Memory Space: u0bsYQWyNZ.elf PID: 5660, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: Process Memory Space: u0bsYQWyNZ.elf PID: 5660, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16 |
Source: Process Memory Space: u0bsYQWyNZ.elf PID: 5668, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: Process Memory Space: u0bsYQWyNZ.elf PID: 5668, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16 |
Source: Process Memory Space: u0bsYQWyNZ.elf PID: 5677, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: Process Memory Space: u0bsYQWyNZ.elf PID: 5677, type: MEMORYSTR | Matched rule: Linux_Trojan_Gafgyt_ea92cca8 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = aa4aee9f3d6bedd8234eaf8778895a0f5d71c42b21f2a428f01f121e85704e8e, id = ea92cca8-bba7-4a1c-9b88-a2d051ad0021, last_modified = 2021-09-16 |
Source: /tmp/u0bsYQWyNZ.elf (PID: 5563) | File opened: /proc/490/fd | Jump to behavior |
Source: /tmp/u0bsYQWyNZ.elf (PID: 5563) | File opened: /proc/791/fd | Jump to behavior |
Source: /tmp/u0bsYQWyNZ.elf (PID: 5563) | File opened: /proc/794/fd | Jump to behavior |
Source: /tmp/u0bsYQWyNZ.elf (PID: 5563) | File opened: /proc/795/fd | Jump to behavior |
Source: /tmp/u0bsYQWyNZ.elf (PID: 5563) | File opened: /proc/797/fd | Jump to behavior |
Source: /tmp/u0bsYQWyNZ.elf (PID: 5563) | File opened: /proc/853/fd | Jump to behavior |
Source: /tmp/u0bsYQWyNZ.elf (PID: 5563) | File opened: /proc/917/fd | Jump to behavior |
Source: /tmp/u0bsYQWyNZ.elf (PID: 5563) | File opened: /proc/780/fd | Jump to behavior |
Source: /tmp/u0bsYQWyNZ.elf (PID: 5563) | File opened: /proc/1/fd | Jump to behavior |
Source: /tmp/u0bsYQWyNZ.elf (PID: 5563) | File opened: /proc/661/fd | Jump to behavior |
Source: /tmp/u0bsYQWyNZ.elf (PID: 5563) | File opened: /proc/782/fd | Jump to behavior |
Source: /tmp/u0bsYQWyNZ.elf (PID: 5563) | File opened: /proc/785/fd | Jump to behavior |
Source: /tmp/u0bsYQWyNZ.elf (PID: 5563) | File opened: /proc/940/fd | Jump to behavior |
Source: /tmp/u0bsYQWyNZ.elf (PID: 5563) | File opened: /proc/767/fd | Jump to behavior |
Source: /tmp/u0bsYQWyNZ.elf (PID: 5563) | File opened: /proc/800/fd | Jump to behavior |
Source: /tmp/u0bsYQWyNZ.elf (PID: 5563) | File opened: /proc/888/fd | Jump to behavior |
Source: /tmp/u0bsYQWyNZ.elf (PID: 5563) | File opened: /proc/801/fd | Jump to behavior |
Source: /tmp/u0bsYQWyNZ.elf (PID: 5563) | File opened: /proc/725/fd | Jump to behavior |
Source: /tmp/u0bsYQWyNZ.elf (PID: 5563) | File opened: /proc/769/fd | Jump to behavior |
Source: /tmp/u0bsYQWyNZ.elf (PID: 5563) | File opened: /proc/726/fd | Jump to behavior |
Source: /tmp/u0bsYQWyNZ.elf (PID: 5563) | File opened: /proc/803/fd | Jump to behavior |
Source: /tmp/u0bsYQWyNZ.elf (PID: 5563) | File opened: /proc/806/fd | Jump to behavior |
Source: /tmp/u0bsYQWyNZ.elf (PID: 5563) | File opened: /proc/807/fd | Jump to behavior |
Source: /tmp/u0bsYQWyNZ.elf (PID: 5563) | File opened: /proc/928/fd | Jump to behavior |
Source: /tmp/u0bsYQWyNZ.elf (PID: 5569) | File opened: /proc/490/fd | Jump to behavior |
Source: /tmp/u0bsYQWyNZ.elf (PID: 5569) | File opened: /proc/791/fd | Jump to behavior |
Source: /tmp/u0bsYQWyNZ.elf (PID: 5569) | File opened: /proc/794/fd | Jump to behavior |
Source: /tmp/u0bsYQWyNZ.elf (PID: 5569) | File opened: /proc/795/fd | Jump to behavior |
Source: /tmp/u0bsYQWyNZ.elf (PID: 5569) | File opened: /proc/797/fd | Jump to behavior |
Source: /tmp/u0bsYQWyNZ.elf (PID: 5569) | File opened: /proc/853/fd | Jump to behavior |
Source: /tmp/u0bsYQWyNZ.elf (PID: 5569) | File opened: /proc/917/fd | Jump to behavior |
Source: /tmp/u0bsYQWyNZ.elf (PID: 5569) | File opened: /proc/780/fd | Jump to behavior |
Source: /tmp/u0bsYQWyNZ.elf (PID: 5569) | File opened: /proc/1/fd | Jump to behavior |
Source: /tmp/u0bsYQWyNZ.elf (PID: 5569) | File opened: /proc/661/fd | Jump to behavior |
Source: /tmp/u0bsYQWyNZ.elf (PID: 5569) | File opened: /proc/782/fd | Jump to behavior |
Source: /tmp/u0bsYQWyNZ.elf (PID: 5569) | File opened: /proc/785/fd | Jump to behavior |
Source: /tmp/u0bsYQWyNZ.elf (PID: 5569) | File opened: /proc/940/fd | Jump to behavior |
Source: /tmp/u0bsYQWyNZ.elf (PID: 5569) | File opened: /proc/767/fd | Jump to behavior |
Source: /tmp/u0bsYQWyNZ.elf (PID: 5569) | File opened: /proc/800/fd | Jump to behavior |
Source: /tmp/u0bsYQWyNZ.elf (PID: 5569) | File opened: /proc/888/fd | Jump to behavior |
Source: /tmp/u0bsYQWyNZ.elf (PID: 5569) | File opened: /proc/801/fd | Jump to behavior |
Source: /tmp/u0bsYQWyNZ.elf (PID: 5569) | File opened: /proc/725/fd | Jump to behavior |
Source: /tmp/u0bsYQWyNZ.elf (PID: 5569) | File opened: /proc/769/fd | Jump to behavior |
Source: /tmp/u0bsYQWyNZ.elf (PID: 5569) | File opened: /proc/726/fd | Jump to behavior |
Source: /tmp/u0bsYQWyNZ.elf (PID: 5569) | File opened: /proc/803/fd | Jump to behavior |
Source: /tmp/u0bsYQWyNZ.elf (PID: 5569) | File opened: /proc/806/fd | Jump to behavior |
Source: /tmp/u0bsYQWyNZ.elf (PID: 5569) | File opened: /proc/807/fd | Jump to behavior |
Source: /tmp/u0bsYQWyNZ.elf (PID: 5569) | File opened: /proc/928/fd | Jump to behavior |
Source: 5537.20.dr | Binary or memory string: -9915837702310A--gzvmware kernel module |
Source: 5537.20.dr | Binary or memory string: -1116261022170A--gzQEMU User Emulator |
Source: 5537.20.dr | Binary or memory string: qemu-or1k |
Source: 5537.20.dr | Binary or memory string: qemu-riscv64 |
Source: 5537.20.dr | Binary or memory string: qemu-arm |
Source: u0bsYQWyNZ.elf, 5561.1.000055e9c3b38000.000055e9c3bbd000.rw-.sdmp, u0bsYQWyNZ.elf, 5563.1.000055e9c3b38000.000055e9c3bbd000.rw-.sdmp, u0bsYQWyNZ.elf, 5660.1.000055e9c3b38000.000055e9c3bbd000.rw-.sdmp, u0bsYQWyNZ.elf, 5677.1.000055e9c3b38000.000055e9c3bbd000.rw-.sdmp, u0bsYQWyNZ.elf, 5665.1.000055e9c3b38000.000055e9c3bbd000.rw-.sdmp, u0bsYQWyNZ.elf, 5564.1.000055e9c3b38000.000055e9c3bbd000.rw-.sdmp, u0bsYQWyNZ.elf, 5668.1.000055e9c3b38000.000055e9c3bbd000.rw-.sdmp, u0bsYQWyNZ.elf, 5570.1.000055e9c3b38000.000055e9c3bbd000.rw-.sdmp | Binary or memory string: U!/etc/qemu-binfmt/m68k |
Source: 5537.20.dr | Binary or memory string: (qemu |
Source: 5537.20.dr | Binary or memory string: qemu-tilegx |
Source: 5537.20.dr | Binary or memory string: qemu-hppa |
Source: 5537.20.dr | Binary or memory string: q{rqemu% |
Source: 5537.20.dr | Binary or memory string: )qemu |
Source: 5537.20.dr | Binary or memory string: vmware-toolbox-cmd |
Source: 5537.20.dr | Binary or memory string: qemu-ppc |
Source: 5537.20.dr | Binary or memory string: Tqemu9 |
Source: u0bsYQWyNZ.elf, 5561.1.000055e9c3b38000.000055e9c3bbd000.rw-.sdmp, u0bsYQWyNZ.elf, 5563.1.000055e9c3b38000.000055e9c3bbd000.rw-.sdmp, u0bsYQWyNZ.elf, 5660.1.000055e9c3b38000.000055e9c3bbd000.rw-.sdmp, u0bsYQWyNZ.elf, 5677.1.000055e9c3b38000.000055e9c3bbd000.rw-.sdmp, u0bsYQWyNZ.elf, 5665.1.000055e9c3b38000.000055e9c3bbd000.rw-.sdmp, u0bsYQWyNZ.elf, 5564.1.000055e9c3b38000.000055e9c3bbd000.rw-.sdmp, u0bsYQWyNZ.elf, 5668.1.000055e9c3b38000.000055e9c3bbd000.rw-.sdmp, u0bsYQWyNZ.elf, 5570.1.000055e9c3b38000.000055e9c3bbd000.rw-.sdmp | Binary or memory string: /etc/qemu-binfmt/m68k |
Source: 5537.20.dr | Binary or memory string: qemu-aarch64_be |
Source: 5537.20.dr | Binary or memory string: 0qemu9 |
Source: 5537.20.dr | Binary or memory string: qemu-sparc64 |
Source: 5537.20.dr | Binary or memory string: qemu-mips64 |
Source: 5537.20.dr | Binary or memory string: vV:qemu9 |
Source: 5537.20.dr | Binary or memory string: <prezip-bin-1116269780060A--gzprefix zip delta word list compressor/decompressornameif-8815490444730A--gzname network interfaces based on MAC addressesxdg-user-dirs-update-1115483406210A--gzUpdate XDG user dir configurationip-link-8815816145190A--gznetwork device configurationhpsa-4415812813670A--gzHP Smart Array SCSI driverhd4-4415812813670A--gzMFM/IDE hard disk devicessane-canon630u-5516003468200A--gzSANE backend for the Canon 630u USB flatbed scannersg_copy_results-8815825816070A--gzsend SCSI RECEIVE COPY RESULTS command (XCOPY related)grub-macbless-8816214898500A--gzbless a mac file/directoryntfstruncate-8815568625640A-tgztruncate a file on an NTFS volumelessfile-1115936459130B--gz"input preprocessor" for less.sane-artec-5516003468200A--gzSANE backend for Artec flatbed scannersrmdir-1115676799200A--gzremove empty directoriessystemd-networkd-wait-online.service-8816268940210A--gzWait for network to come onlinemkfs.ntfs-8815568625640B-tgzcreate an NTFS file systemsg_inq-8815825816070A--gzissue SCSI INQUIRY command and/or decode its responseradattr.so-8815955079440Cpppd-radattr-gzc_rehash-1ssl116164130370B--gzCreate symbolic links to files named by the hash valuestc-htb-8815816145190A--gzHierarchy Token Bucketgvfs-open-1115868766090A--gzsg_rbuf-8815825816070A--gzreads data using SCSI READ BUFFER commandglib-compile-schemas-1116155671180A--gzGSettings schema compileropenssl-srp-1ssl116164130370B--gzmaintain SRP password fileopenssl-rehash-1ssl116164130370B--gzCreate symbolic links to files named by the hash valueslibvmtools-3315837702310A--gzvmware shared librarypasswd5-5515906478670A--gzthe password filenet::dbus::dumperNet::DBus::Dumper3pm315773746310A--gzStringify Net::DBus objects suitable for printingsane-hp4200-5516003468200A--gzSANE backend for Hewlett-Packard 4200 scannersposixoptions-7715812813670A--gzoptional parts of the POSIX standardnetworkmanager.confNetworkManager.conf5516002723180A--gzNetworkManager configuration fileownership-8815771238010A--gzCompaq ownership tag retrieveroakdecode-1115804162510A--gzDecode an OAKT printer stream into human readable form.gvfs-save-1115868766090A--gzmkfs.minix-8815953177680A--gzmake a Minix filesystemuri7-7715812813670A--gzuniform resource identifier (URI), including a URL or URNedit-1115714399500B--gzexecute programs via entries in the mailcap filegit-diff-files-1116148628880A--gzCompares files in the working tree and the index.ldaprc-5516136581350Cldap.conf-gzpactl-1116219586 |