Edit tour

Linux Analysis Report
byte.mips.elf

Overview

General Information

Sample name:	byte.mips.elf
Analysis ID:	1551087
MD5:	442269900f28ef10d8b7a13f2bc5ed86
SHA1:	2f997966590600fb4b5572f306a40bcbb6fe79eb
SHA256:	a1badb5317009fe55702c638b0c5816a92337e855e83db12e99e721db7b193c3
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai, Okiru

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sample tries to kill a massive number of system processes

Yara detected Mirai

Yara detected Okiru

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

Found strings indicative of a multi-platform dropper

Reads CPU information from /sys indicative of miner or evasive malware

Reads system information from the proc file system

Reads the 'hosts' file potentially containing internal network hosts

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1551087
Start date and time:	2024-11-07 13:30:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 21s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	byte.mips.elf
Detection:	MAL
Classification:	mal100.spre.troj.linELF@0/1040@1/0

Warnings

Connection to analysis system has been lost, crash info: Unknown
VT rate limit hit for: byte.mips.elf

Runtime Messages

Command:	/tmp/byte.mips.elf
PID:	5433
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	lzrd cock fest"/proc/"/exe
Standard Error:

Process Tree

system is lnxubuntu20

byte.mips.elf (PID: 5433, Parent: 5355, MD5: 0083f1f0e77be34ad27f849842bbb00c) Arguments: /tmp/byte.mips.elf

byte.mips.elf New Fork (PID: 5435, Parent: 5433)

byte.mips.elf New Fork (PID: 5437, Parent: 5433)

byte.mips.elf New Fork (PID: 5438, Parent: 5433)

byte.mips.elf New Fork (PID: 5441, Parent: 5438)

byte.mips.elf New Fork (PID: 5443, Parent: 5438)

byte.mips.elf New Fork (PID: 5444, Parent: 5438)

byte.mips.elf New Fork (PID: 5446, Parent: 5438)

systemd New Fork (PID: 5450, Parent: 1)

journalctl (PID: 5450, Parent: 1, MD5: bf3a987344f3bacafc44efd882abda8b) Arguments: /usr/bin/journalctl --smart-relinquish-var

systemd New Fork (PID: 5470, Parent: 1)

dbus-daemon (PID: 5470, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5483, Parent: 1)

rsyslogd (PID: 5483, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5484, Parent: 2935)

pulseaudio (PID: 5484, Parent: 2935, MD5: 0c3b4c789d8ffb12b25507f27e14c186) Arguments: /usr/bin/pulseaudio --daemonize=no --log-target=journal

gvfsd-fuse New Fork (PID: 5485, Parent: 3122)

fusermount (PID: 5485, Parent: 3122, MD5: 576a1b135c82bdcbc97a91acea900566) Arguments: fusermount -u -q -z -- /run/user/1000/gvfs

systemd New Fork (PID: 5488, Parent: 1)

systemd-journald (PID: 5488, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 5489, Parent: 1)

dbus-daemon (PID: 5489, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5493, Parent: 1)

rsyslogd (PID: 5493, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5499, Parent: 1)

systemd-logind (PID: 5499, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 5556, Parent: 1)

dbus-daemon (PID: 5556, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

gdm3 New Fork (PID: 5557, Parent: 1400)

Default (PID: 5557, Parent: 1400, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

gdm3 New Fork (PID: 5558, Parent: 1400)

Default (PID: 5558, Parent: 1400, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 5559, Parent: 1)

rsyslogd (PID: 5559, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

gdm3 New Fork (PID: 5560, Parent: 1400)

Default (PID: 5560, Parent: 1400, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /etc/gdm3/PrimeOff/Default

systemd New Fork (PID: 5561, Parent: 1)

systemd-journald (PID: 5561, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 5564, Parent: 1)

systemd-logind (PID: 5564, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 5609, Parent: 1)

dbus-daemon (PID: 5609, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5624, Parent: 1)

rsyslogd (PID: 5624, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5625, Parent: 1)

gpu-manager (PID: 5625, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 5629, Parent: 5625)

sh (PID: 5629, Parent: 5625, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5630, Parent: 5629)

grep (PID: 5630, Parent: 5629, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5631, Parent: 5625)

sh (PID: 5631, Parent: 5625, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5632, Parent: 5631)

grep (PID: 5632, Parent: 5631, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5633, Parent: 5625)

sh (PID: 5633, Parent: 5625, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5634, Parent: 5633)

grep (PID: 5634, Parent: 5633, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5635, Parent: 5625)

sh (PID: 5635, Parent: 5625, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5636, Parent: 5635)

grep (PID: 5636, Parent: 5635, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5637, Parent: 5625)

sh (PID: 5637, Parent: 5625, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5638, Parent: 5637)

grep (PID: 5638, Parent: 5637, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5639, Parent: 5625)

sh (PID: 5639, Parent: 5625, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*amdgpu[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5640, Parent: 5639)

grep (PID: 5640, Parent: 5639, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*amdgpu[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

systemd New Fork (PID: 5641, Parent: 1)

dbus-daemon (PID: 5641, Parent: 1, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

systemd New Fork (PID: 5642, Parent: 1)

generate-config (PID: 5642, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 5643, Parent: 5642)

pkill (PID: 5643, Parent: 5642, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 5644, Parent: 1)

rsyslogd (PID: 5644, Parent: 1, MD5: 0b8087fc907c42eb3c81a691db258e33) Arguments: /usr/sbin/rsyslogd -n -iNONE

systemd New Fork (PID: 5645, Parent: 1)

systemd-journald (PID: 5645, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 5648, Parent: 1)

systemd-logind (PID: 5648, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 5710, Parent: 1)

systemd-logind (PID: 5710, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 5767, Parent: 1)

gpu-manager (PID: 5767, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 5768, Parent: 5767)

sh (PID: 5768, Parent: 5767, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5769, Parent: 5768)

grep (PID: 5769, Parent: 5768, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5772, Parent: 5767)

sh (PID: 5772, Parent: 5767, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5773, Parent: 5772)

grep (PID: 5773, Parent: 5772, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5774, Parent: 5767)

sh (PID: 5774, Parent: 5767, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5834, Parent: 5774)

grep (PID: 5834, Parent: 5774, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

systemd New Fork (PID: 5777, Parent: 1)

systemd-logind (PID: 5777, Parent: 1, MD5: 8dd58a1b4c12f7a1d5fe3ce18b2aaeef) Arguments: /lib/systemd/systemd-logind

systemd New Fork (PID: 5835, Parent: 1)

generate-config (PID: 5835, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 5836, Parent: 5835)

pkill (PID: 5836, Parent: 5835, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 5837, Parent: 1)

systemd-journald (PID: 5837, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 5840, Parent: 1)

gpu-manager (PID: 5840, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 5841, Parent: 5840)

sh (PID: 5841, Parent: 5840, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5842, Parent: 5841)

grep (PID: 5842, Parent: 5841, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

systemd New Fork (PID: 5843, Parent: 1)

generate-config (PID: 5843, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 5844, Parent: 5843)

pkill (PID: 5844, Parent: 5843, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 5845, Parent: 1)

systemd-journald (PID: 5845, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 5846, Parent: 1)

gpu-manager (PID: 5846, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 5847, Parent: 5846)

sh (PID: 5847, Parent: 5846, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5848, Parent: 5847)

grep (PID: 5848, Parent: 5847, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

systemd New Fork (PID: 5849, Parent: 1)

systemd-journald (PID: 5849, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 5850, Parent: 1)

generate-config (PID: 5850, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 5851, Parent: 5850)

pkill (PID: 5851, Parent: 5850, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 5854, Parent: 1)

systemd-journald (PID: 5854, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 5855, Parent: 1)

gpu-manager (PID: 5855, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

gpu-manager New Fork (PID: 5856, Parent: 5855)

sh (PID: 5856, Parent: 5855, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5857, Parent: 5856)

grep (PID: 5857, Parent: 5856, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

gpu-manager New Fork (PID: 5858, Parent: 5855)

sh (PID: 5858, Parent: 5855, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*nvidia[[:space:]]*$\" /lib/modprobe.d/*.conf"

sh New Fork (PID: 5859, Parent: 5858)

grep (PID: 5859, Parent: 5858, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*nvidia[[:space:]]*$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf

gpu-manager New Fork (PID: 5860, Parent: 5855)

sh (PID: 5860, Parent: 5855, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "grep -G \"^blacklist.*radeon[[:space:]]*$\" /etc/modprobe.d/*.conf"

sh New Fork (PID: 5861, Parent: 5860)

grep (PID: 5861, Parent: 5860, MD5: 1e6ebb9dd094f774478f72727bdba0f5) Arguments: grep -G ^blacklist.*radeon[[:space:]]*$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf

systemd New Fork (PID: 5862, Parent: 1)

generate-config (PID: 5862, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

generate-config New Fork (PID: 5863, Parent: 5862)

pkill (PID: 5863, Parent: 5862, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill --signal HUP --uid gdm dconf-service

systemd New Fork (PID: 5864, Parent: 1)

systemd-journald (PID: 5864, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 5865, Parent: 1)

systemd-journald (PID: 5865, Parent: 1, MD5: 474667ece6cecb5e04c6eb897a1d0d9e) Arguments: /lib/systemd/systemd-journald

systemd New Fork (PID: 5866, Parent: 1)

gpu-manager (PID: 5866, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

systemd New Fork (PID: 5867, Parent: 1)

generate-config (PID: 5867, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

systemd New Fork (PID: 5870, Parent: 1)

gpu-manager (PID: 5870, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

systemd New Fork (PID: 5871, Parent: 1)

generate-config (PID: 5871, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

systemd New Fork (PID: 5872, Parent: 1)

gpu-manager (PID: 5872, Parent: 1, MD5: 8fae9dd5dd67e1f33d873089c2fd8761) Arguments: /usr/bin/gpu-manager --log /var/log/gpu-manager.log

systemd New Fork (PID: 5873, Parent: 1)

generate-config (PID: 5873, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

systemd New Fork (PID: 5875, Parent: 1)

generate-config (PID: 5875, Parent: 1, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: /usr/share/gdm/generate-config

systemd New Fork (PID: 5879, Parent: 2935)

dbus-daemon (PID: 5879, Parent: 2935, MD5: 3089d47e3f3ab84cd81c48fd406d7a8c) Arguments: /usr/bin/dbus-daemon --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
byte.mips.elf	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
byte.mips.elf	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
byte.mips.elf	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
byte.mips.elf	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0x1d420:$x1: POST /cdn-cgi/ 0x2225a:$x5: .mdebug.abi32 0x1ecb0:$s1: LCOGQGPTGP
byte.mips.elf	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x1d420:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A

Memory Dumps

Source	Rule	Description	Author	Strings
5437.1.00007f8ca8400000.00007f8ca8421000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5437.1.00007f8ca8400000.00007f8ca8421000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
5437.1.00007f8ca8400000.00007f8ca8421000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
5437.1.00007f8ca8400000.00007f8ca8421000.r-x.sdmp	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0x1d420:$x1: POST /cdn-cgi/ 0x1ecb0:$s1: LCOGQGPTGP
5437.1.00007f8ca8400000.00007f8ca8421000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x1d420:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
5444.1.00007f8ca8400000.00007f8ca8421000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5444.1.00007f8ca8400000.00007f8ca8421000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
5444.1.00007f8ca8400000.00007f8ca8421000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
5444.1.00007f8ca8400000.00007f8ca8421000.r-x.sdmp	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0x1d420:$x1: POST /cdn-cgi/ 0x1ecb0:$s1: LCOGQGPTGP
5444.1.00007f8ca8400000.00007f8ca8421000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x1d420:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
5433.1.00007f8ca8400000.00007f8ca8421000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5433.1.00007f8ca8400000.00007f8ca8421000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
5433.1.00007f8ca8400000.00007f8ca8421000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
5433.1.00007f8ca8400000.00007f8ca8421000.r-x.sdmp	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0x1d420:$x1: POST /cdn-cgi/ 0x1ecb0:$s1: LCOGQGPTGP
5433.1.00007f8ca8400000.00007f8ca8421000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x1d420:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
5446.1.00007f8ca8400000.00007f8ca8421000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5446.1.00007f8ca8400000.00007f8ca8421000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
5446.1.00007f8ca8400000.00007f8ca8421000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
5446.1.00007f8ca8400000.00007f8ca8421000.r-x.sdmp	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0x1d420:$x1: POST /cdn-cgi/ 0x1ecb0:$s1: LCOGQGPTGP
5446.1.00007f8ca8400000.00007f8ca8421000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x1d420:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
5435.1.00007f8ca8400000.00007f8ca8421000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5435.1.00007f8ca8400000.00007f8ca8421000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
5435.1.00007f8ca8400000.00007f8ca8421000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
5435.1.00007f8ca8400000.00007f8ca8421000.r-x.sdmp	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0x1d420:$x1: POST /cdn-cgi/ 0x1ecb0:$s1: LCOGQGPTGP
5435.1.00007f8ca8400000.00007f8ca8421000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x1d420:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
5438.1.00007f8ca8400000.00007f8ca8421000.r-x.sdmp	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
5438.1.00007f8ca8400000.00007f8ca8421000.r-x.sdmp	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
5438.1.00007f8ca8400000.00007f8ca8421000.r-x.sdmp	JoeSecurity_Mirai_5	Yara detected Mirai	Joe Security
5438.1.00007f8ca8400000.00007f8ca8421000.r-x.sdmp	Mirai_Botnet_Malware	Detects Mirai Botnet Malware	Florian Roth	0x1d420:$x1: POST /cdn-cgi/ 0x1ecb0:$s1: LCOGQGPTGP
5438.1.00007f8ca8400000.00007f8ca8421000.r-x.sdmp	MAL_ELF_LNX_Mirai_Oct10_2	Detects ELF malware Mirai related	Florian Roth	0x1d420:$c01: 50 4F 53 54 20 2F 63 64 6E 2D 63 67 69 2F 00 00 20 48 54 54 50 2F 31 2E 31 0D 0A 55 73 65 72 2D 41 67 65 6E 74 3A 20 00 0D 0A 48 6F 73 74 3A
Process Memory Space: byte.mips.elf PID: 5433	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: byte.mips.elf PID: 5433	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
Process Memory Space: byte.mips.elf PID: 5435	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: byte.mips.elf PID: 5435	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
Process Memory Space: byte.mips.elf PID: 5437	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: byte.mips.elf PID: 5437	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
Process Memory Space: byte.mips.elf PID: 5438	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: byte.mips.elf PID: 5438	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
Process Memory Space: byte.mips.elf PID: 5444	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: byte.mips.elf PID: 5444	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
Process Memory Space: byte.mips.elf PID: 5446	JoeSecurity_Okiru	Yara detected Okiru	Joe Security
Process Memory Space: byte.mips.elf PID: 5446	JoeSecurity_Mirai_9	Yara detected Mirai	Joe Security
Click to see the 37 entries

String: byte/proc/%d/net/tcp %*d: %*x:%x/proc//proc/%s/exe/proc/self/exe/proc/proc/%d/cmdlinenetstatwgettftpftpcurlbusybox/bin/busyboxvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/soraJoshohajime902i13BzSxLxBxeYHOHO-LUGO7HOHO-U79OLJuYfouyf87NiGGeR69xdSO190Ij1XLOLKIKEEEDDEekjheory98escansh4MDMAfdevalvexscanspcMELTEDNINJAREALZflexsonskidsscanx86MISAKI-U79OLfoAxi102kxeswodjwodjwojMmKiy7f87lfreecookiex86sysgpufrgegesysupdater0DnAzepdNiGGeRD0nks69frgreu0x766f6964NiGGeRd0nks1337gafturasgbsigboa120i3UI49OaF3geaevaiolmao123123aOfurain0n4H34DggTrexewwasads1293194hjXDOthLaLosnggtwget-log1337SoraLOADERSAIAKINAggtq1378bfp919GRB1Q2SAIAKUSOggtr14FaSEXSLAVE1337ggtt1902a3u912u3u4haetrghbr19ju3dSORAojkf120hehahejeje922U2JDJA901F91SlaVLav12helpmedaddthhhhh2wgg9qphbqSlav3Th3seD3viceshzSmYZjYMQ5GbfSoRAxD123LOLiaGv5aA3SoRAxD420LOLinsomni640277SoraBeReppin1337ipcamCache66tlGg9QjUYfouyf876ke3TOKYO3lyEeaXul2dULCVxh93OfjHZ2zTY2gD6MZvKc7KU6rmMkiy6f87lA023UU4U24UIUTheWeekndmioribitchesA5p9TheWeekndsmnblkjpoiAbAdTokyosnebAkiruU8inTznetstatsAlexW9RCAKM20TnewnetwordAyo215WordnloadsBAdAsVWordmanenotyakuzaaBelchWordnetsobpBigN0gg0r420X0102I34fofhasfhiafhoiX19I239124UIUoismXSHJEHHEIIHWOolsVNwo12DeportedDeportedXkTer0GbA1onry0v03FortniteDownLOLZY0urM0mGaypussyfartlmaojkGrAcEnIgGeRaNnYvdGkqndCOqGeoRBe6BEGuiltyCrownZEuS69s4beBsEQhdHOHO-KSNDOZEuz69sat1234aj93hJ23scanHAalie293z0k2LscanJoshoARMHellInSideayyyGangShitscanJoshoARM5HighFryb1glscanJoshoARM6IWhPyucDbJboatnetzscanJoshoARM7IuYgujeIqnbtbatrtahzexsexscanJoshoM68KJJDUHEWBBBIBscanJoshoMIPSJSDGIEVIVAVIGcKbVkzGOPascanJoshoMPSLccADscanJoshoPPCKAZEN-OIU97chickenxingsscanJoshoSH4yakuskzm8KAZEN-PO78HcleanerscanJoshoSPCKAZEN-U79OLdbeefscanJoshoX86yakuz4c24KETASHI32ddrwelperscanarm5zPnr6HpQj2Kaishi-Iz90Ydeexecscanarm6zdrtfxcgyKatrina32doCP3fVjscanarm7zxcfhuioKsif91je39scanm68kKuasadvrhelperl33t_feetl33tl33tfeetscanmipsKuasaBinsMateeQnOhRk85rscanmpslLOLHHHOHOHBUIeXK20CL12ZnyamezyQBotBladeSPOOKYhikariwasherep4029x91xx32uhj4gbejhwizardzhra.outboatnetdbgcondiheroshimaskid.dbglzrdPownedSecurity69.aresfxlyazsxhyUNSTABLEunstable_is_the_story_of_the_universemoobotjnsd9sdoilayourmomgaeissdfjiougsiojOasisSEGRJIJHFVNHSNHEIHFOSapep999KOWAI-BAdAsVKOWAI-SADjHKipU7Ylairdropmalwareyour_verry_fucking_gayBig-Bro-Brightsefaexecshirololieagle.For-Gai-Mezy0x6axNLcloqkisvspookymythSwergjmioGKILLEJW(IU(JIWERGFJGJWJRGHetrhwewrtheIuFdKssCxzjSDFJIjioOnrYoXd666ewrtkjokethajbdf89wu823AAaasrdgsWsGA4@F6FGhostWuzHere666BOGOMIPSbeastmodedvrHelperbestmodesfc6aJfIuYDemon.xeno-is-godICY-P-0ODIJgSHUIHIfhwrgLhu87VhvQPzlunadakuexecbinTacoBellGodYololigangExecutionorbitclientAmnesi

Source: /usr/bin/pkill (PID: 5643)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5844)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5851)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5863)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior

Source: /usr/sbin/rsyslogd (PID: 5493)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5624)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5644)	Reads hosts file: /etc/hosts	Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 5488)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5561)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5645)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5837)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5845)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5849)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5854)	Socket: unknown address family	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5864)	Socket: unknown address family	Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 89.71.131.207
Source: unknown	TCP traffic detected without corresponding DNS query: 192.220.213.215
Source: unknown	TCP traffic detected without corresponding DNS query: 209.231.129.207
Source: unknown	TCP traffic detected without corresponding DNS query: 8.44.0.101
Source: unknown	TCP traffic detected without corresponding DNS query: 19.211.108.209
Source: unknown	TCP traffic detected without corresponding DNS query: 148.228.213.91
Source: unknown	TCP traffic detected without corresponding DNS query: 87.155.47.43
Source: unknown	TCP traffic detected without corresponding DNS query: 13.250.44.66
Source: unknown	TCP traffic detected without corresponding DNS query: 245.117.186.204
Source: unknown	TCP traffic detected without corresponding DNS query: 108.68.152.103
Source: unknown	TCP traffic detected without corresponding DNS query: 222.184.83.38
Source: unknown	TCP traffic detected without corresponding DNS query: 34.59.105.129
Source: unknown	TCP traffic detected without corresponding DNS query: 180.128.82.200
Source: unknown	TCP traffic detected without corresponding DNS query: 84.247.193.22
Source: unknown	TCP traffic detected without corresponding DNS query: 16.181.184.26
Source: unknown	TCP traffic detected without corresponding DNS query: 190.251.132.29
Source: unknown	TCP traffic detected without corresponding DNS query: 172.53.60.113
Source: unknown	TCP traffic detected without corresponding DNS query: 47.17.40.247
Source: unknown	TCP traffic detected without corresponding DNS query: 46.203.106.255
Source: unknown	TCP traffic detected without corresponding DNS query: 44.38.233.151
Source: unknown	TCP traffic detected without corresponding DNS query: 90.155.8.234
Source: unknown	TCP traffic detected without corresponding DNS query: 60.73.5.17
Source: unknown	TCP traffic detected without corresponding DNS query: 213.111.149.240
Source: unknown	TCP traffic detected without corresponding DNS query: 34.72.244.227
Source: unknown	TCP traffic detected without corresponding DNS query: 85.143.13.237
Source: unknown	TCP traffic detected without corresponding DNS query: 195.120.95.125
Source: unknown	TCP traffic detected without corresponding DNS query: 147.125.112.185
Source: unknown	TCP traffic detected without corresponding DNS query: 135.131.253.37
Source: unknown	TCP traffic detected without corresponding DNS query: 121.80.20.227
Source: unknown	TCP traffic detected without corresponding DNS query: 78.150.136.105
Source: unknown	TCP traffic detected without corresponding DNS query: 97.73.53.96
Source: unknown	TCP traffic detected without corresponding DNS query: 216.102.158.26
Source: unknown	TCP traffic detected without corresponding DNS query: 194.46.57.137
Source: unknown	TCP traffic detected without corresponding DNS query: 191.244.63.233
Source: unknown	TCP traffic detected without corresponding DNS query: 188.174.207.226
Source: unknown	TCP traffic detected without corresponding DNS query: 221.247.47.51
Source: unknown	TCP traffic detected without corresponding DNS query: 122.182.247.210
Source: unknown	TCP traffic detected without corresponding DNS query: 112.239.238.249
Source: unknown	TCP traffic detected without corresponding DNS query: 116.67.213.207
Source: unknown	TCP traffic detected without corresponding DNS query: 160.157.64.89
Source: unknown	TCP traffic detected without corresponding DNS query: 207.249.113.189
Source: unknown	TCP traffic detected without corresponding DNS query: 20.127.231.48
Source: unknown	TCP traffic detected without corresponding DNS query: 57.204.24.12
Source: unknown	TCP traffic detected without corresponding DNS query: 39.213.234.148
Source: unknown	TCP traffic detected without corresponding DNS query: 63.247.37.162
Source: unknown	TCP traffic detected without corresponding DNS query: 172.191.225.206
Source: unknown	TCP traffic detected without corresponding DNS query: 83.236.213.173
Source: unknown	TCP traffic detected without corresponding DNS query: 13.204.115.87
Source: unknown	TCP traffic detected without corresponding DNS query: 79.32.7.101
Source: unknown	TCP traffic detected without corresponding DNS query: 218.195.59.236

Source: byte.mips.elf, type: SAMPLE	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: byte.mips.elf, type: SAMPLE	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5437.1.00007f8ca8400000.00007f8ca8421000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 5437.1.00007f8ca8400000.00007f8ca8421000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5444.1.00007f8ca8400000.00007f8ca8421000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 5444.1.00007f8ca8400000.00007f8ca8421000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5433.1.00007f8ca8400000.00007f8ca8421000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 5433.1.00007f8ca8400000.00007f8ca8421000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5446.1.00007f8ca8400000.00007f8ca8421000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 5446.1.00007f8ca8400000.00007f8ca8421000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5435.1.00007f8ca8400000.00007f8ca8421000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 5435.1.00007f8ca8400000.00007f8ca8421000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth
Source: 5438.1.00007f8ca8400000.00007f8ca8421000.r-x.sdmp, type: MEMORY	Matched rule: Detects Mirai Botnet Malware Author: Florian Roth
Source: 5438.1.00007f8ca8400000.00007f8ca8421000.r-x.sdmp, type: MEMORY	Matched rule: Detects ELF malware Mirai related Author: Florian Roth

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: /bin/busybox
Source: Initial sample	String containing 'busybox' found: busyboxxx
Source: Initial sample	String containing 'busybox' found: busyboxx
Source: Initial sample	String containing 'busybox' found: byte/proc/%d/net/tcp %d: %x:%x/proc//proc/%s/exe/proc/self/exe/proc/proc/%d/cmdlinenetstatwgettftpftpcurlbusybox/bin/busyboxvar/Challengeapp/hi3511gmDVRiboxusr/dvr_main _8182T_1108mnt/mtd/app/guivar/Kylinl0 c/udevdanko-app/ankosample _8182T_1104var/tmp/soniahicorestm_hi3511_dvr/usr/lib/systemd/systemd/usr/libexec/openssh/sftp-serverusr/shellmnt/sys/bin/boot/media/srv/var/run/sbin/lib/etc/dev/home/Davincitelnetsshwatchdog/var/spool/var/Sofiasshd/usr/compress/bin//compress/bin/compress/usr/bashhttpdtelnetddropbearropbearencodersystem/root/dvr_gui//root/dvr_app//anko-app//opt/soraJoshohajime902i13BzSxLxBxeYHOHO-LUGO7HOHO-U79OLJuYfouyf87NiGGeR69xdSO190Ij1XLOLKIKEEEDDEekjheory98escansh4MDMAfdevalvexscanspcMELTEDNINJAREALZflexsonskidsscanx86MISAKI-U79OLfoAxi102kxeswodjwodjwojMmKiy7f87lfreecookiex86sysgpufrgegesysupdater0DnAzepdNiGGeRD0nks69frgreu0x766f6964NiGGeRd0nks1337gafturasgbsigboa120i3UI49OaF3geaevaiolmao123123aOfurain0n4H34DggTrexewwasads1293194hjXDOthLaLosnggtwget-log1337SoraLOADERSAIAKINAggtq1378bfp919GR

Source: byte.mips.elf, type: SAMPLE	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: byte.mips.elf, type: SAMPLE	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5437.1.00007f8ca8400000.00007f8ca8421000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 5437.1.00007f8ca8400000.00007f8ca8421000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5444.1.00007f8ca8400000.00007f8ca8421000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 5444.1.00007f8ca8400000.00007f8ca8421000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5433.1.00007f8ca8400000.00007f8ca8421000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 5433.1.00007f8ca8400000.00007f8ca8421000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5446.1.00007f8ca8400000.00007f8ca8421000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 5446.1.00007f8ca8400000.00007f8ca8421000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5435.1.00007f8ca8400000.00007f8ca8421000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 5435.1.00007f8ca8400000.00007f8ca8421000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research
Source: 5438.1.00007f8ca8400000.00007f8ca8421000.r-x.sdmp, type: MEMORY	Matched rule: Mirai_Botnet_Malware date = 2016-10-04, hash5 = 420bf9215dfb04e5008c5e522eee9946599e2b323b17f17919cd802ebb012175, hash4 = 2efa09c124f277be2199bee58f49fc0ce6c64c0bef30079dfb3d94a6de492a69, hash3 = 20683ff7a5fec1237fc09224af40be029b9548c62c693844624089af568c89d4, hash2 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, hash1 = 05c78c3052b390435e53a87e3d31e9fb17f7c76bb4df2814313bca24735ce81c, author = Florian Roth, description = Detects Mirai Botnet Malware, hash10 = c61bf95146c68bfbbe01d7695337ed0e93ea759f59f651799f07eecdb339f83f, hash11 = d9573c3850e2ae35f371dff977fc3e5282a5e67db8e3274fd7818e8273fd5c89, hash12 = f1100c84abff05e0501e77781160d9815628e7fd2de9e53f5454dbcac7c84ca5, hash9 = bf0471b37dba7939524a30d7d5afc8fcfb8d4a7c9954343196737e72ea4e2dc4, hash8 = 89570ae59462e6472b6769545a999bde8457e47ae0d385caaa3499ab735b8147, hash7 = 70bb0ec35dd9afcfd52ec4e1d920e7045dc51dca0573cd4c753987c9d79405c0, hash6 = 62cdc8b7fffbaf5683a466f6503c03e68a15413a90f6afd5a13ba027631460c6, reference = Internal Research, license = https://creativecommons.org/licenses/by-nc/4.0/, hash13 = fb713ccf839362bf0fbe01aedd6796f4d74521b133011b408e42c1fd9ab8246b
Source: 5438.1.00007f8ca8400000.00007f8ca8421000.r-x.sdmp, type: MEMORY	Matched rule: MAL_ELF_LNX_Mirai_Oct10_2 date = 2018-10-27, hash1 = fa0018e75f503f9748a5de0d14d4358db234f65e28c31c8d5878cc58807081c9, author = Florian Roth, description = Detects ELF malware Mirai related, reference = Internal Research

Source: /usr/bin/dbus-daemon (PID: 5470)	File: /proc/5470/mounts	Jump to behavior
Source: /bin/fusermount (PID: 5485)	File: /proc/5485/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5489)	File: /proc/5489/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5556)	File: /proc/5556/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 5609)	File: /proc/5609/mounts	Jump to behavior

Source: /lib/systemd/systemd-logind (PID: 5564)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5564)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 5564)	File: /run/systemd/seats/.#seat0kZhV7U	Jump to behavior

Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/238/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/239/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/119/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/10/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/11/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/5272/net/tcp	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/12/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/13/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/14/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/15/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/16/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/17/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/18/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/19/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/240/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/120/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/241/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/121/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/242/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/1/net/tcp	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/1/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/122/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/243/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/2/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/123/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/244/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/3/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/124/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/245/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/4/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/125/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/246/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/5/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/126/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/247/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/6/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/127/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/248/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/7/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/128/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/249/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/800/net/tcp	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/800/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/8/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/129/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/9/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/20/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/21/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/22/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/23/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/24/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/25/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/26/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/27/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/28/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/29/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/5840/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/250/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/371/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/130/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/251/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/131/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/252/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/132/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/253/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/254/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/1238/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/134/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/255/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/256/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/257/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/378/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/258/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/1475/net/tcp	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/1475/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/259/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/5710/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/936/net/tcp	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/936/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/30/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/5835/net/tcp	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/5836/net/tcp	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/5837/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/5837/net/tcp	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/35/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/3792/net/tcp	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/5850/cmdline	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	File opened: /proc/5851/cmdline	Jump to behavior

Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 490, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 660, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 726, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 727, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 765, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 767, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 778, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 780, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 783, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 790, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 795, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 800, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent to PID below 1000: pid: 936, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	SIGKILL sent to PID below 1000: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	SIGKILL sent to PID below 1000: pid: 660, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	SIGKILL sent to PID below 1000: pid: 726, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	SIGKILL sent to PID below 1000: pid: 765, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	SIGKILL sent to PID below 1000: pid: 767, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	SIGKILL sent to PID below 1000: pid: 778, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	SIGKILL sent to PID below 1000: pid: 780, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	SIGKILL sent to PID below 1000: pid: 783, result: no such process	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	SIGKILL sent to PID below 1000: pid: 790, result: no such process	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	SIGKILL sent to PID below 1000: pid: 800, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	SIGKILL sent to PID below 1000: pid: 936, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	SIGKILL sent to PID below 1000: pid: 2, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	SIGKILL sent to PID below 1000: pid: 3, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	SIGKILL sent to PID below 1000: pid: 4, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	SIGKILL sent to PID below 1000: pid: 5, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	SIGKILL sent to PID below 1000: pid: 6, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	SIGKILL sent to PID below 1000: pid: 7, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	SIGKILL sent to PID below 1000: pid: 8, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	SIGKILL sent to PID below 1000: pid: 9, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	SIGKILL sent to PID below 1000: pid: 10, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	SIGKILL sent to PID below 1000: pid: 11, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	SIGKILL sent to PID below 1000: pid: 12, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	SIGKILL sent to PID below 1000: pid: 13, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	SIGKILL sent to PID below 1000: pid: 14, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	SIGKILL sent to PID below 1000: pid: 15, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	SIGKILL sent to PID below 1000: pid: 16, result: successful	Jump to behavior

Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent: pid: 490, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent: pid: 660, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent: pid: 726, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent: pid: 727, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent: pid: 765, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent: pid: 767, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent: pid: 778, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent: pid: 780, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent: pid: 783, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent: pid: 790, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent: pid: 795, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent: pid: 800, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent: pid: 1400, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent: pid: 1410, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent: pid: 1411, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent: pid: 1432, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent: pid: 1475, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent: pid: 1565, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent: pid: 1805, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent: pid: 2926, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent: pid: 2935, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent: pid: 2936, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent: pid: 2970, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent: pid: 3069, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent: pid: 3132, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent: pid: 5272, result: no such process	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent: pid: 5416, result: no such process	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent: pid: 5417, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent: pid: 5438, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	SIGKILL sent: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	SIGKILL sent: pid: 660, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	SIGKILL sent: pid: 726, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	SIGKILL sent: pid: 765, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	SIGKILL sent: pid: 767, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	SIGKILL sent: pid: 778, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	SIGKILL sent: pid: 780, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	SIGKILL sent: pid: 783, result: no such process	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	SIGKILL sent: pid: 790, result: no such process	Jump to behavior

Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent: pid: 490, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent: pid: 660, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent: pid: 726, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent: pid: 727, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent: pid: 765, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent: pid: 767, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent: pid: 778, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent: pid: 780, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent: pid: 783, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent: pid: 790, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent: pid: 795, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent: pid: 800, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent: pid: 1400, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent: pid: 1410, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent: pid: 1411, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent: pid: 1432, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent: pid: 1475, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent: pid: 1565, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent: pid: 1805, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent: pid: 2926, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent: pid: 2935, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent: pid: 2936, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent: pid: 2970, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent: pid: 3069, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent: pid: 3132, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent: pid: 5272, result: no such process	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent: pid: 5416, result: no such process	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent: pid: 5417, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5435)	SIGKILL sent: pid: 5438, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	SIGKILL sent: pid: 1 (init), result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	SIGKILL sent: pid: 660, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	SIGKILL sent: pid: 726, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	SIGKILL sent: pid: 765, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	SIGKILL sent: pid: 767, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	SIGKILL sent: pid: 778, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	SIGKILL sent: pid: 780, result: successful	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	SIGKILL sent: pid: 783, result: no such process	Jump to behavior
Source: /tmp/byte.mips.elf (PID: 5443)	SIGKILL sent: pid: 790, result: no such process	Jump to behavior

Source: /usr/bin/gpu-manager (PID: 5629)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5631)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5633)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5635)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5637)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5639)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5768)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5772)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5774)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5841)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5847)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5856)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5858)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5860)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior

Source: /bin/sh (PID: 5630)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5632)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5634)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5636)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5638)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5640)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5769)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5773)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5834)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5842)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5848)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5857)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 5859)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 5861)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior

Source: /usr/share/gdm/generate-config (PID: 5643)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 5836)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 5844)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 5851)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 5863)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service	Jump to behavior

Source: /lib/systemd/systemd-journald (PID: 5488)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5561)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5645)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5837)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5845)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5849)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5854)	Reads from proc file: /proc/meminfo	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5864)	Reads from proc file: /proc/meminfo	Jump to behavior

Source: /usr/sbin/rsyslogd (PID: 5493)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5624)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 5644)	Log file created: /var/log/kern.log	Jump to dropped file

Source: /usr/bin/gpu-manager (PID: 5625)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5767)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5840)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5846)	Truncated file: /var/log/gpu-manager.log	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5855)	Truncated file: /var/log/gpu-manager.log	Jump to behavior

Source: /tmp/byte.mips.elf (PID: 5433)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5483)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5488)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5493)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5559)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5561)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5624)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 5625)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 5644)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5645)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5837)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5845)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5849)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5854)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 5864)	Queries kernel information via 'uname':	Jump to behavior

Source: byte.mips.elf, 5433.1.00007ffd491f2000.00007ffd49213000.rw-.sdmp, byte.mips.elf, 5435.1.00007ffd491f2000.00007ffd49213000.rw-.sdmp, byte.mips.elf, 5437.1.00007ffd491f2000.00007ffd49213000.rw-.sdmp, byte.mips.elf, 5438.1.00007ffd491f2000.00007ffd49213000.rw-.sdmp, byte.mips.elf, 5444.1.00007ffd491f2000.00007ffd49213000.rw-.sdmp, byte.mips.elf, 5446.1.00007ffd491f2000.00007ffd49213000.rw-.sdmp	Binary or memory string: [x86_64/usr/bin/qemu-mips/tmp/byte.mips.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/byte.mips.elf
Source: byte.mips.elf, 5433.1.0000555bceb57000.0000555bcebde000.rw-.sdmp, byte.mips.elf, 5435.1.0000555bceb57000.0000555bcebde000.rw-.sdmp, byte.mips.elf, 5437.1.0000555bceb57000.0000555bcebde000.rw-.sdmp, byte.mips.elf, 5438.1.0000555bceb57000.0000555bcebde000.rw-.sdmp, byte.mips.elf, 5444.1.0000555bceb57000.0000555bcebde000.rw-.sdmp, byte.mips.elf, 5446.1.0000555bceb57000.0000555bcebde000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/mips
Source: syslog.35.dr	Binary or memory string: Nov 7 06:30:54 galassia kernel: [ 104.718366] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel parport_pc ppdev lp drm parport ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper psmouse mptspi scsi_transport_spi ahci mptscsih libahci mptbase vmxnet3
Source: byte.mips.elf, 5433.1.00007ffd491f2000.00007ffd49213000.rw-.sdmp, byte.mips.elf, 5435.1.00007ffd491f2000.00007ffd49213000.rw-.sdmp, byte.mips.elf, 5437.1.00007ffd491f2000.00007ffd49213000.rw-.sdmp, byte.mips.elf, 5438.1.00007ffd491f2000.00007ffd49213000.rw-.sdmp, byte.mips.elf, 5444.1.00007ffd491f2000.00007ffd49213000.rw-.sdmp, byte.mips.elf, 5446.1.00007ffd491f2000.00007ffd49213000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-mips
Source: byte.mips.elf, 5433.1.0000555bceb57000.0000555bcebde000.rw-.sdmp, byte.mips.elf, 5435.1.0000555bceb57000.0000555bcebde000.rw-.sdmp, byte.mips.elf, 5437.1.0000555bceb57000.0000555bcebde000.rw-.sdmp, byte.mips.elf, 5438.1.0000555bceb57000.0000555bcebde000.rw-.sdmp, byte.mips.elf, 5444.1.0000555bceb57000.0000555bcebde000.rw-.sdmp, byte.mips.elf, 5446.1.0000555bceb57000.0000555bcebde000.rw-.sdmp	Binary or memory string: [U!/etc/qemu-binfmt/mips
Source: syslog.35.dr	Binary or memory string: Nov 7 06:30:54 galassia kernel: [ 104.715805] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020

Source: Yara match	File source: byte.mips.elf, type: SAMPLE
Source: Yara match	File source: 5437.1.00007f8ca8400000.00007f8ca8421000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5444.1.00007f8ca8400000.00007f8ca8421000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5433.1.00007f8ca8400000.00007f8ca8421000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5446.1.00007f8ca8400000.00007f8ca8421000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5435.1.00007f8ca8400000.00007f8ca8421000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 5438.1.00007f8ca8400000.00007f8ca8421000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: byte.mips.elf PID: 5433, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: byte.mips.elf PID: 5435, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: byte.mips.elf PID: 5437, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: byte.mips.elf PID: 5438, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: byte.mips.elf PID: 5444, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: byte.mips.elf PID: 5446, type: MEMORYSTR

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	2 Scripting	Valid Accounts	Windows Management Instrumentation	2 Scripting	Path Interception	1 Disable or Modify Tools	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Non-Standard Port	Exfiltration Over Other Network Medium	2 Service Stop
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Hidden Files and Directories	LSASS Memory	11 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Indicator Removal	Security Account Manager	2 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Source	Detection	Scanner	Label	Link
byte.mips.elf	55%	ReversingLabs	Linux.Trojan.Mirai
byte.mips.elf	100%	Avira	LINUX/Mirai.bonb

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report byte.mips.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Spreading

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/run/systemd/seats/.#seat0kZhV7U

/tmp/qemu-open.00ADTK (deleted)

/tmp/qemu-open.06uCyN (deleted)

/tmp/qemu-open.07lMyN (deleted)

/tmp/qemu-open.0CvPqL (deleted)

/tmp/qemu-open.0IGeKM (deleted)

/tmp/qemu-open.0MmYiL (deleted)

/tmp/qemu-open.0MnOEL (deleted)

/tmp/qemu-open.0N9IIK (deleted)

/tmp/qemu-open.0PqrKM (deleted)

/tmp/qemu-open.0RJXcM (deleted)

/tmp/qemu-open.0XlaZM (deleted)

/tmp/qemu-open.0YUBtL (deleted)

/tmp/qemu-open.0bpMJL (deleted)

/tmp/qemu-open.0nwwJL (deleted)

/tmp/qemu-open.0smlIK (deleted)

/tmp/qemu-open.0tmuyM (deleted)

/tmp/qemu-open.0vJ8cM (deleted)

/tmp/qemu-open.0xDqxK (deleted)

/tmp/qemu-open.135d2N (deleted)

/tmp/qemu-open.1BgE2N (deleted)

/tmp/qemu-open.1JTg2J (deleted)

/tmp/qemu-open.1UAZQL (deleted)

/tmp/qemu-open.1YdyPK (deleted)

/tmp/qemu-open.1YwnJN (deleted)

/tmp/qemu-open.1i4lQJ (deleted)

/tmp/qemu-open.1idONN (deleted)

/tmp/qemu-open.1jbZnO (deleted)

/tmp/qemu-open.1ppExN (deleted)

Linux Analysis Report
byte.mips.elf

IP	Domain	Country	ASN	ASN Name	Malicious
148.16.78.129	unknown	United States	6400	CompaniaDominicanadeTelefonosSADO	false
243.71.59.40	unknown	Reserved	unknown	unknown	false
147.101.41.221	unknown	United States	2200	FR-RENATERReseauNationaldetelecommunicationspourlaTec	false
247.246.74.133	unknown	Reserved	unknown	unknown	false
194.46.57.137	unknown	United Kingdom	12513	ECLIPSEGB	false
222.184.83.38	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
70.229.144.197	unknown	United States	7018	ATT-INTERNET4US	false
154.190.23.122	unknown	Egypt	8452	TE-ASTE-ASEG	false
40.180.69.40	unknown	United States	4249	LILLY-ASUS	false
38.170.90.98	unknown	United States	174	COGENT-174US	false
32.158.26.240	unknown	United States	2686	ATGS-MMD-ASUS	false
14.170.191.202	unknown	Viet Nam	45899	VNPT-AS-VNVNPTCorpVN	false
190.195.241.66	unknown	Argentina	10481	TelecomArgentinaSAAR	false
97.73.53.96	unknown	United States	6621	HNS-DIRECPCUS	false
89.71.131.207	unknown	Poland	6830	LIBERTYGLOBALLibertyGlobalformerlyUPCBroadbandHolding	false
154.23.33.73	unknown	United States	174	COGENT-174US	false
122.182.247.210	unknown	India	24560	AIRTELBROADBAND-AS-APBhartiAirtelLtdTelemediaServices	false
95.117.73.186	unknown	Germany	6805	TDDE-ASN1DE	false
161.15.66.162	unknown	United States	61231	SSE-TELECOMSGB	false
172.191.225.206	unknown	United States	7018	ATT-INTERNET4US	false
118.19.174.132	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
13.20.155.186	unknown	United States	395959	XEROX-ELLUS	false
13.250.44.66	unknown	United States	16509	AMAZON-02US	false
241.134.126.255	unknown	Reserved	unknown	unknown	false
148.187.135.161	unknown	Switzerland	559	SWITCHPeeringrequestspeeringswitchchEU	false
209.76.155.146	unknown	United States	7132	SBIS-ASUS	false
85.143.13.237	unknown	Russian Federation	8623	UNN-ASNizhnyNovgorodRussiaRU	false
93.193.65.153	unknown	Germany	3320	DTAGInternetserviceprovideroperationsDE	false
167.228.95.242	unknown	United States	2897	GEORGIA-1US	false
101.196.17.155	unknown	China	58519	CHINATELECOM-CTCLOUDCloudComputingCorporationCN	false
255.84.76.87	unknown	Reserved	unknown	unknown	false
9.211.20.226	unknown	United States	3356	LEVEL3US	false
71.238.182.33	unknown	United States	7922	COMCAST-7922US	false
112.239.238.249	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
85.52.209.82	unknown	Spain	12479	UNI2-ASES	false
223.254.16.173	unknown	China	45671	AS45671-NET-AUWholesaleServicesProviderAU	false
184.84.237.230	unknown	United States	55836	RELIANCEJIO-INRelianceJioInfocommLimitedIN	false
194.109.188.235	unknown	Netherlands	3265	XS4ALL-NLAmsterdamNL	false
91.205.72.198	unknown	Poland	41508	PL-IWACOM-ASPL	false
48.59.166.55	unknown	United States	2686	ATGS-MMD-ASUS	false
8.151.253.199	unknown	Singapore	37963	CNNIC-ALIBABA-CN-NET-APHangzhouAlibabaAdvertisingCoLtd	false
102.221.65.255	unknown	unknown	36926	CKL1-ASNKE	false
181.184.174.210	unknown	Venezuela	6306	TELEFONICAVENEZOLANACAVE	false
170.10.74.226	unknown	United States	395555	ELEVATEUS	false
176.119.228.227	unknown	Kazakhstan	59583	ASNETKAZAHSTANKZ	false
108.68.152.103	unknown	United States	7018	ATT-INTERNET4US	false
53.136.199.213	unknown	Germany	31399	DAIMLER-ASITIGNGlobalNetworkDE	false
195.120.95.125	unknown	Italy	3269	ASN-IBSNAZIT	false
39.220.106.217	unknown	Indonesia	23693	TELKOMSEL-ASN-IDPTTelekomunikasiSelularID	false
133.75.179.20	unknown	Japan	9591	NIFSNationalInstituteforFusionScienceJP	false
23.238.154.37	unknown	United States	40676	AS40676US	false
109.147.89.163	unknown	United Kingdom	2856	BT-UK-ASBTnetUKRegionalnetworkGB	false
124.8.75.94	unknown	Taiwan; Republic of China (ROC)	9924	TFN-TWTaiwanFixedNetworkTelcoandNetworkServiceProvi	false
83.236.213.173	unknown	Germany	20676	PLUSNETDE	false
201.52.183.23	unknown	Brazil	28573	CLAROSABR	false
86.125.75.90	unknown	Romania	8708	RCS-RDS73-75DrStaicoviciRO	false
135.131.253.37	unknown	United States	14962	NCR-252US	false
188.174.207.226	unknown	Germany	8767	MNET-ASGermanyDE	false
34.72.244.227	unknown	United States	15169	GOOGLEUS	false
13.50.163.159	unknown	United States	16509	AMAZON-02US	false
133.162.151.120	unknown	Japan	2510	INFOWEBFUJITSULIMITEDJP	false
182.188.99.90	unknown	Pakistan	45595	PKTELECOM-AS-PKPakistanTelecomCompanyLimitedPK	false
43.114.154.109	unknown	Japan	4249	LILLY-ASUS	false
86.65.27.138	unknown	France	15557	LDCOMNETFR	false
96.48.252.253	unknown	Canada	6327	SHAWCA	false
39.213.234.148	unknown	Indonesia	23693	TELKOMSEL-ASN-IDPTTelekomunikasiSelularID	false
209.231.129.207	unknown	United States	7029	WINDSTREAMUS	false
116.67.213.207	unknown	Japan	2527	SO-NETSo-netEntertainmentCorporationJP	false
210.147.216.181	unknown	Japan	2518	BIGLOBEBIGLOBEIncJP	false
182.93.8.190	unknown	Macau	4609	CTM-MOCompanhiadeTelecomunicacoesdeMacauSARLMO	false
221.247.47.51	unknown	Japan	17506	UCOMARTERIANetworksCorporationJP	false
253.59.120.203	unknown	Reserved	unknown	unknown	false
90.161.77.51	unknown	Spain	12479	UNI2-ASES	false
73.223.56.168	unknown	United States	7922	COMCAST-7922US	false
103.252.7.70	unknown	India	132996	THREESAINFOWAY-ASThreesaInfowayPvtLtdIN	false
240.58.86.62	unknown	Reserved	unknown	unknown	false
245.117.186.204	unknown	Reserved	unknown	unknown	false
148.23.158.158	unknown	United States	6400	CompaniaDominicanadeTelefonosSADO	false
157.213.18.37	unknown	United States	4704	SANNETRakutenMobileIncJP	false
254.173.116.251	unknown	Reserved	unknown	unknown	false
182.63.35.145	unknown	Malaysia	4818	DIGIIX-APDiGiTelecommunicationsSdnBhdMY	false
147.98.207.74	unknown	France	34006	VEEPEE-ASNFR	false
13.138.151.138	unknown	United States	7018	ATT-INTERNET4US	false
69.11.88.246	unknown	Canada	803	SASKTELCA	false
180.128.82.200	unknown	Thailand	45223	WIN-AS-TH-APWorldInternetworkCoLtdThailandTH	false
96.182.106.225	unknown	United States	7922	COMCAST-7922US	false
136.88.151.93	unknown	United States	60311	ONEFMCH	false
106.165.74.7	unknown	Japan	2516	KDDIKDDICORPORATIONJP	false
152.182.115.230	unknown	United States	701	UUNETUS	false
170.94.169.22	unknown	United States	21852	DISNW1US	false
123.173.197.125	unknown	China	4809	CHINATELECOM-CORE-WAN-CN2ChinaTelecomNextGenerationCarr	false
168.237.177.146	unknown	United States	3136	STATE-OF-WISCONSIN-AS1US	false
110.45.112.75	unknown	Korea Republic of	10066	GAYANET-AS-KRLGHelloVisionCorpKR	false
188.115.216.23	unknown	Armenia	44395	ORG-UL31-RIPEAM	false
4.39.116.47	unknown	United States	46164	ATT-MOBILITY-LABSUS	false
110.231.78.97	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
19.211.108.209	unknown	United States	3	MIT-GATEWAYSUS	false
123.212.231.181	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	false
213.30.129.206	unknown	France	12670	AS-COMPLETELFR	false
66.252.103.111	unknown	United States	19578	TRUENET-INCUS	false

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CompaniaDominicanadeTelefonosSADO	8WdO7I87E1.elf	Get hash	malicious	Mirai, Moobot	Browse	148.38.180.228
	lB5MFPhwRY.elf	Get hash	malicious	Mirai, Moobot	Browse	64.32.100.54
	nuklear.arm.elf	Get hash	malicious	Mirai, Moobot	Browse	148.26.55.138
	yakuza.m68k.elf	Get hash	malicious	Unknown	Browse	148.180.74.154
	yakuza.mipsel.elf	Get hash	malicious	Unknown	Browse	148.31.222.3
	IGz.arm7.elf	Get hash	malicious	Mirai, Moobot	Browse	201.229.142.145
	debug.dbg.elf	Get hash	malicious	Mirai, Gafgyt	Browse	150.76.31.58
	mpsl.elf	Get hash	malicious	Mirai, Gafgyt	Browse	148.45.91.12
	ppc.elf	Get hash	malicious	Mirai, Gafgyt	Browse	186.7.126.173
	x86.elf	Get hash	malicious	Mirai	Browse	150.64.112.120
FR-RENATERReseauNationaldetelecommunicationspourlaTec	bin.x86_64.elf	Get hash	malicious	Mirai	Browse	157.136.166.4
	bin.spc.elf	Get hash	malicious	Mirai	Browse	128.93.97.245
	sDX1AXN1Zp.elf	Get hash	malicious	Mirai, Moobot	Browse	81.194.78.113
	9JvpARJbsQ.elf	Get hash	malicious	Mirai, Moobot	Browse	147.250.11.180
	spc.elf	Get hash	malicious	Mirai	Browse	194.57.196.117
	nuklear.arm.elf	Get hash	malicious	Mirai, Moobot	Browse	145.238.14.208
	W6Z9uSRsKQ.elf	Get hash	malicious	Unknown	Browse	157.136.46.228
	B6eg13TpEH.elf	Get hash	malicious	Unknown	Browse	130.66.21.210
	jew.arm.elf	Get hash	malicious	Unknown	Browse	129.199.156.101
	la.bot.sh4.elf	Get hash	malicious	Mirai	Browse	163.173.54.89
CHINANET-BACKBONENo31Jin-rongStreetCN	sora.ppc.elf	Get hash	malicious	Unknown	Browse	1.49.127.76
	bin.x86_64.elf	Get hash	malicious	Mirai	Browse	222.84.82.179
	bin.arm.elf	Get hash	malicious	Mirai	Browse	218.92.181.126
	bin.m68k.elf	Get hash	malicious	Mirai	Browse	36.47.163.33
	bin.spc.elf	Get hash	malicious	Mirai	Browse	115.217.129.74
	bin.mips.elf	Get hash	malicious	Mirai	Browse	219.144.203.150
	bin.arm7.elf	Get hash	malicious	Mirai	Browse	122.7.199.254
	debug.dbg.elf	Get hash	malicious	Mirai	Browse	122.7.204.196
	sora.arm7.elf	Get hash	malicious	Unknown	Browse	182.133.200.198
	sora.mpsl.elf	Get hash	malicious	Unknown	Browse	124.231.210.123
ECLIPSEGB	Q4UjkaEwAS.exe	Get hash	malicious	Unknown	Browse	82.156.90.96
	SecuriteInfo.com.Win32.DropperX-gen.17897.26677.exe	Get hash	malicious	Unknown	Browse	82.156.90.96
	debug.dbg.elf	Get hash	malicious	Gafgyt, Mirai	Browse	82.156.228.94
	fCr6yd61xw.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	109.176.30.246
	fCr6yd61xw.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	109.176.30.246
	la.bot.arm5.elf	Get hash	malicious	Unknown	Browse	91.84.67.99
	la.bot.m68k.elf	Get hash	malicious	Unknown	Browse	91.84.215.0
	la.bot.sparc.elf	Get hash	malicious	Unknown	Browse	82.156.253.60
	gBYV3uACcC.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	109.176.30.246
	gBYV3uACcC.exe	Get hash	malicious	PureLog Stealer, zgRAT	Browse	109.176.30.246

Process:	/lib/systemd/systemd-logind
File Type:	ASCII text
Category:	dropped
Size (bytes):	95
Entropy (8bit):	4.921230646592726
Encrypted:	false
SSDEEP:	3:SbFVVmFyinKMsuH47rLg205vmLUbr+v:SbFuFyLwH47Pg20ggWv
MD5:	BE58CCABC942125F5E27AF6EB1BA2F88
SHA1:	07C20F55E36EE48869B223B8FC4DBC227C7353AC
SHA-256:	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
SHA-512:	E5A270995FDE80530927E0BACD3BF76EE820C968AABD55D2E34579326F388AFD6DE7FB8C5D54F69D3F6AC30A5B587FD3B0456FC60326E7DF4F45789A900D046C
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	# This is private data. Do not parse..IS_SEAT0=1.CAN_MULTI_SESSION=1.CAN_TTY=1.CAN_GRAPHICAL=0.

Process:	/lib/systemd/systemd-journald
File Type:	data
Category:	dropped
Size (bytes):	240
Entropy (8bit):	1.4428593527838256
Encrypted:	false
SSDEEP:	3:F31HlXjlNzll:F35r
MD5:	0DE605A66C965258587E12E279158992
SHA1:	68387A737C23B10CD76D04DC3BF55E3CD1229F17
SHA-256:	8A5C6AA9AFFED7018CEFD422D6FE310175AF750FCC7E4F8CCB6E021731B4313C
SHA-512:	493D0127FAD108BA9F24646FE9375BA15A36F6C89A344EE315D4B5A624E2E42C062D15191B8D052D018B777FBE556E29BD6E63F91D17AC6E795D447A9E1E6A8D
Malicious:	false
Preview:	LPKSHHRH.................;...E?.X;...B3.................................;...E?.X;...B3........................................................................................................................................................

Process:	/usr/sbin/rsyslogd
File Type:	ASCII text
Category:	dropped
Size (bytes):	2884
Entropy (8bit):	4.757280221645706
Encrypted:	false
SSDEEP:	48:x1yapYKDP+UOqAsnq5kqKqp/mt8xjp3P7jpfqDjg6nj795gg9unt9zFd96W9M9QO:ctaH9k9b6+maSFn
MD5:	648B8C04C4A180B9DDBD93A922098072
SHA1:	4EB864EB59F734D3D044EF8DF3FCD00A9A0DB970
SHA-256:	A2C6D83FCC323095B2E6F0B2648AC17F6888C6EB39FBC6EC27941AA7FB8FACA8
SHA-512:	6830857B47D33E9F3CD823CC39599EC9B6BB2813BAFC9D313310F30340CF1113867D4A5CB15E9F5EA215927700735EC12B283C7AAA458477DEFBCEBF106B84A4
Malicious:	false
Preview:	Nov 7 06:31:00 galassia kernel: [ 110.950130] New task spawned: old: (tgid 5639, tid 5639), new (tgid: 5640, tid: 5640).Nov 7 06:31:00 galassia kernel: [ 111.233574] blocking signal 9: 5443 -> 1.Nov 7 06:31:00 galassia kernel: [ 111.257606] New task spawned: old: (tgid 5642, tid 5642), new (tgid: 5643, tid: 5643).Nov 7 06:31:00 galassia kernel: [ 111.264814] blocking signal 9: 5443 -> 660.Nov 7 06:31:00 galassia kernel: [ 111.278230] blocking signal 9: 5443 -> 726.Nov 7 06:31:00 galassia kernel: [ 111.290456] blocking signal 9: 5443 -> 765.Nov 7 06:31:00 galassia kernel: [ 111.302105] blocking signal 9: 5443 -> 767.Nov 7 06:31:00 galassia kernel: [ 111.313815] blocking signal 9: 5443 -> 778.Nov 7 06:31:00 galassia kernel: [ 111.325413] blocking signal 9: 5443 -> 936.Nov 7 06:31:00 galassia kernel: [ 111.337408] blocking signal 9: 5443 -> 1410.Nov 7 06:31:00 galassia kernel: [ 111.348761] blocking signal 9: 5443 -> 1411.Nov 7 06:31:00 galassia kernel: [ 111.36065

File type:	ELF 32-bit MSB executable, MIPS, MIPS-I version 1 (SYSV), statically linked, stripped
Entropy (8bit):	5.615261279006586
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	byte.mips.elf
File size:	140'440 bytes
MD5:	442269900f28ef10d8b7a13f2bc5ed86
SHA1:	2f997966590600fb4b5572f306a40bcbb6fe79eb
SHA256:	a1badb5317009fe55702c638b0c5816a92337e855e83db12e99e721db7b193c3
SHA512:	d861babc3d83bf705aa5efd5276e928d6335eabfe58c604968315f865ae1765fe9b099b21de8045b3acfc6b66b5c384ec39888dd72d69bc4105703cff9e19db1
SSDEEP:	3072:qrnyNbdXcu87FWrF+64IjFY0aeTHkHVs149tL:qryNbtcNFOF+64IjFYeDbstL
TLSH:	F0D3D74E7E218F7EFBA8C23547B74E21965933D623E1D584D19CEA021E7038A741FB98
File Content Preview:	.ELF.....................@.`...4.."h.....4. ...(.............@...@...........................F...F........7X........dt.Q............................<...'..\|...!'.......................<...'..X...!... ....'9... ......................<...'..(...!........'9.

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	MIPS R3000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x400260
Flags:	0x1007
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	139880
Section Header Size:	40
Number of Section Headers:	14
Header String Table Index:	13

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0
.init	PROGBITS	0x400094	0x94	0x8c	0x0	0x6	AX	4
.text	PROGBITS	0x400120	0x120	0x1d2a0	0x0	0x6	AX	16
.fini	PROGBITS	0x41d3c0	0x1d3c0	0x5c	0x0	0x6	AX	4
.rodata	PROGBITS	0x41d420	0x1d420	0x34d0	0x0	0x2	A	16
.ctors	PROGBITS	0x461000	0x21000	0x8	0x0	0x3	WA	4
.dtors	PROGBITS	0x461008	0x21008	0x8	0x0	0x3	WA	4
.data.rel.ro	PROGBITS	0x461014	0x21014	0xc	0x0	0x3	WA	4
.data	PROGBITS	0x461020	0x21020	0xcf8	0x0	0x3	WA	16
.got	PROGBITS	0x461d20	0x21d20	0x4e4	0x4	0x10000003	WAp	16
.sbss	NOBITS	0x462204	0x22204	0x20	0x0	0x10000003	WAp	4
.bss	NOBITS	0x462230	0x22204	0x2528	0x0	0x3	WA	16
.mdebug.abi32	PROGBITS	0xaf8	0x22204	0x0	0x0	0x0		1
.shstrtab	STRTAB	0x0	0x22204	0x64	0x0	0x0		1

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x208f0	0x208f0	5.6503	0x5	R E	0x10000	.init .text .fini .rodata
LOAD	0x21000	0x461000	0x461000	0x1204	0x3758	4.5580	0x6	RW	0x10000	.ctors .dtors .data.rel.ro .data .got .sbss .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x7	RWE	0x4

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 7, 2024 13:30:52.900784969 CET	47009	53	192.168.2.13	8.8.8.8
Nov 7, 2024 13:30:53.447900057 CET	53	47009	8.8.8.8	192.168.2.13