Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: unknown |
DNS traffic detected: query: raw.qxej27mv7hud1uk03kj438ggzby0v7a8mgwwnmky2n9vn1tmcn1qpm8kax84ymn.ru. [malformed] |
Source: r0tEgU8WOn.elf, type: SAMPLE |
Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown |
Source: 5446.1.00007efb94001000.00007efb94014000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown |
Source: Process Memory Space: r0tEgU8WOn.elf PID: 5446, type: MEMORYSTR |
Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown |
Source: r0tEgU8WOn.elf, type: SAMPLE |
Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: 5446.1.00007efb94001000.00007efb94014000.r-x.sdmp, type: MEMORY |
Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: Process Memory Space: r0tEgU8WOn.elf PID: 5446, type: MEMORYSTR |
Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16 |
Source: r0tEgU8WOn.elf, 5446.1.00007ffeeebc7000.00007ffeeebe8000.rw-.sdmp |
Binary or memory string: x86_64/usr/bin/qemu-m68k/tmp/r0tEgU8WOn.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/r0tEgU8WOn.elf |
Source: r0tEgU8WOn.elf, 5446.1.00007ffeeebc7000.00007ffeeebe8000.rw-.sdmp |
Binary or memory string: U/tmp/qemu-open.TEb6aZ\DX |
Source: r0tEgU8WOn.elf, 5446.1.00007ffeeebc7000.00007ffeeebe8000.rw-.sdmp |
Binary or memory string: /tmp/qemu-open.TEb6aZ |
Source: r0tEgU8WOn.elf, 5446.1.00007ffeeebc7000.00007ffeeebe8000.rw-.sdmp |
Binary or memory string: /qemu-open.XXXXX |
Source: r0tEgU8WOn.elf, 5446.1.000055a88b1de000.000055a88b263000.rw-.sdmp |
Binary or memory string: U!/etc/qemu-binfmt/m68k |
Source: r0tEgU8WOn.elf, 5446.1.00007ffeeebc7000.00007ffeeebe8000.rw-.sdmp |
Binary or memory string: /usr/bin/qemu-m68k |
Source: r0tEgU8WOn.elf, 5446.1.000055a88b1de000.000055a88b263000.rw-.sdmp |
Binary or memory string: /etc/qemu-binfmt/m68k |