Linux Analysis Report
jwwofba5.elf

Overview

General Information

Sample name:	jwwofba5.elf
Analysis ID:	1560606
MD5:	17da38e07a65cc00570a50987d817045
SHA1:	d37454e19f8228bf8c623b6d11e32aedf6f369be
SHA256:	8e7c6f27872f3305dc63a9dd244e6b2027d458d1e725cbc6104afc392d3fc1ee
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	100
Range:	0 - 100
Whitelisted:	false

Signatures

Antivirus / Scanner detection for submitted sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Sample tries to kill a massive number of system processes

Yara detected Mirai

Reads system files that contain records of logged in users

Sample deletes itself

Sample reads /proc/mounts (often used for finding a writable filesystem)

Sample tries to kill multiple processes (SIGKILL)

Sends malformed DNS queries

Creates hidden files and/or directories

Deletes log files

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "grep" command used to find patterns in files or piped streams

Executes the "kill" or "pkill" command typically used to terminate processes

Executes the "ps" command used to list the status of processes

Found strings indicative of a multi-platform dropper

HTTP GET or POST without a user agent

Reads CPU information from /sys indicative of miner or evasive malware

Reads system information from the proc file system

Reads system version information

Reads the 'hosts' file potentially containing internal network hosts

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample has stripped symbol table

Sample listens on a socket

Sample tries to kill a process (SIGKILL)

Sample tries to set the executable flag

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

Malware Threat Intel
Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Signatures

AV Detection

Antivirus / Scanner detection for submitted sample

Source: jwwofba5.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: jwwofba5.elf

ReversingLabs: Detection: 52%

Reads CPU information from /sys indicative of miner or evasive malware

Source: /usr/bin/ps (PID: 6371)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6470)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6575)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6693)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6835)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Found strings indicative of a multi-platform dropper

Source: jwwofba5.elf

String: EOF/proc//proc/%s/cmdlinewgetcurlftpechokillbashrebootshutdownhaltpoweroff[locker] killed process: %s ;; pid: %d

Networking

Sends malformed DNS queries

Source: global traffic

DNS traffic detected: malformed DNS query: ksdjwi.eye-network.ru. [malformed]

Detected TCP or UDP traffic on non-standard ports

Source: global traffic	TCP traffic: 192.168.2.23:50010 -> 89.190.156.145:7733
Source: global traffic	TCP traffic: 192.168.2.23:49656 -> 154.216.16.109:33966

HTTP GET or POST without a user agent

Source: global traffic

HTTP traffic detected: POST /9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e HTTP/1.1Host: daisy.ubuntu.comAccept: */*Content-Type: application/octet-streamX-Whoopsie-Version: 0.2.69ubuntu0.3Content-Length: 164887Expect: 100-continue

Reads the 'hosts' file potentially containing internal network hosts

Source: /usr/sbin/rsyslogd (PID: 6472)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6604)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6698)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6708)	Reads hosts file: /etc/hosts	Jump to behavior

Sample listens on a socket

Source: /lib/systemd/systemd-journald (PID: 6448)	Socket: unknown address family	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6584)	Socket: unknown address family	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6780)	Socket: unknown address family	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6803)	Socket: unknown address family	Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145

Source: global traffic	DNS traffic detected: DNS query: ksdjwi.eye-network.ru
Source: global traffic	DNS traffic detected: DNS query: ksdjwi.eye-network.ru. [malformed]
Source: global traffic	DNS traffic detected: DNS query: daisy.ubuntu.com

Source: unknown

Source: syslog.41.dr, syslog.171.dr, syslog.177.dr, syslog.121.dr

String found in binary or memory: https://www.rsyslog.com

Source: unknown	Network traffic detected: HTTP traffic on port 53816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53816
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: jwwofba5.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6206.1.00007ff428017000.00007ff428039000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6210.1.00007ff428017000.00007ff428039000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: jwwofba5.elf PID: 6206, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: jwwofba5.elf PID: 6210, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Sample tries to kill a massive number of system processes

Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 2, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 3, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 4, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 6, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 9, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 10, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 11, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 12, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 13, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 14, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 15, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 16, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 17, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 18, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 20, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 21, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 22, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 23, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 24, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 25, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 26, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 27, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 28, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 29, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 30, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 35, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 77, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 78, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 79, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 80, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 81, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 82, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 83, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 84, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 85, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 88, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 89, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 91, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 92, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 93, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 94, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 95, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 96, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 97, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 98, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 99, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 100, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 101, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 102, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 103, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 104, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 105, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 106, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 107, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 108, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 109, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 110, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 111, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 112, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 113, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 114, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 115, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 116, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 117, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 118, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 119, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 120, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 121, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 122, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 123, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 124, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 125, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 126, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 127, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 128, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 130, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 132, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 141, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 144, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 157, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 201, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 202, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 203, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 204, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 205, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 206, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 207, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 208, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 209, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 210, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 211, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 212, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 213, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 214, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 215, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 216, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 217, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 218, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 219, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 220, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 221, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 222, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 223, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 224, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 225, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 226, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 227, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 228, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 229, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 230, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 231, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 232, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 233, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 234, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 235, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 236, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 237, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 243, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 248, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 249, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 250, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 251, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 252, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 253, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 254, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 255, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 256, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 257, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 258, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 259, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 260, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 261, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 262, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 263, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 264, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 265, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 266, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 267, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 269, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 270, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 272, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 274, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 278, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 281, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 286, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 322, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 324, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 326, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 327, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 328, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 333, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 346, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 379, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 419, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 420, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 491, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 517, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 654, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 655, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 656, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 657, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 658, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 667, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 670, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 674, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 675, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 676, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 677, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 720, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 721, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 759, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 761, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 772, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 774, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 777, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 785, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 788, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 789, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 793, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 796, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 797, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 799, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 800, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 801, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 847, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 884, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 896, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 904, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 910, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 912, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 918, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 936, result: successful	Jump to behavior

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1638, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6214, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 141, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 144, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 157, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 201, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 208, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 209, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 210, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 211, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 212, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 213, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 214, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 215, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 217, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 218, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 278, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 281, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 286, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 333, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 346, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 379, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 420, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 517, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 654, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 655, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 656, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 657, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 667, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 670, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 675, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 677, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 788, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 789, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 796, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 797, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 799, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 800, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 801, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 847, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 884, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 896, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 904, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 910, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 912, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 918, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1207, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1320, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1349, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1599, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1699, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1809, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1877, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1888, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1890, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1900, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1983, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2009, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2014, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2018, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2025, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2028, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2033, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2038, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2050, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2062, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2063, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2069, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2074, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2077, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2078, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2079, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2080, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2083, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2084, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2096, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2097, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2102, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2114, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2123, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2126, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2128, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2129, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2146, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2156, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2180, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2195, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2208, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2223, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2226, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2235, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2242, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2275, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2281, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2285, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2289, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2294, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2302, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2307, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2637, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2746, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2749, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2761, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2882, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 3021, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 3088, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 3236, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 4443, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 4444, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 4445, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 4446, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 4472, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 4477, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 4496, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6034, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6151, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6158, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6161, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6180, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6181, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6190, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6191, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6219, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6221, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6222, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6223, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6224, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6225, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6226, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6227, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6228, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6229, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6230, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6231, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6232, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6233, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6234, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6235, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6236, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6237, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6369, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6371, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6458, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6470, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6472, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6546, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6584, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6603, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6604, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6605, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6609, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6611, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6697, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6697, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6698, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6702, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6703, result: successful	Jump to behavior

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Source: Initial sample	String containing 'busybox' found: BusyBox
Source: Initial sample	String containing 'busybox' found: BusyBoxps:/proc/%d/exe[killer/exe] killed process: %s ;; pid: %d

Sample has stripped symbol table

Source: ELF static info symbol of initial sample

.symtab present: no

Sample tries to kill a process (SIGKILL)

Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1638, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6214, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 141, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 144, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 157, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 201, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 208, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 209, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 210, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 211, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 212, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 213, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 214, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 215, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 217, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 218, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 278, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 281, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 286, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 333, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 346, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 379, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 420, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 517, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 654, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 655, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 656, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 657, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 667, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 670, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 675, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 677, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 788, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 789, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 796, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 797, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 799, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 800, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 801, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 847, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 884, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 896, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 904, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 910, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 912, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 918, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1207, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1320, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1349, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1599, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1699, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1809, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1877, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1888, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1890, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1900, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1983, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2009, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2014, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2018, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2025, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2028, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2033, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2038, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2050, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2062, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2063, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2069, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2074, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2077, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2078, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2079, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2080, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2083, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2084, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2096, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2097, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2102, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2114, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2123, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2126, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2128, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2129, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2146, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2156, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2180, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2195, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2208, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2223, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2226, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2235, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2242, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2275, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2281, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2285, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2289, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2294, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2302, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2307, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2637, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2746, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2749, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2761, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2882, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 3021, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 3088, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 3236, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 4443, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 4444, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 4445, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 4446, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 4472, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 4477, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 4496, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6034, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6151, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6158, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6161, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6180, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6181, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6190, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6191, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6219, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6221, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6222, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6223, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6224, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6225, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6226, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6227, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6228, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6229, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6230, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6231, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6232, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6233, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6234, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6235, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6236, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6237, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6369, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6371, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6458, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6470, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6472, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6546, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6584, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6603, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6604, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6605, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6609, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6611, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6697, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6697, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6698, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6702, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6703, result: successful	Jump to behavior

Yara signature match

Source: jwwofba5.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6206.1.00007ff428017000.00007ff428039000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6210.1.00007ff428017000.00007ff428039000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: jwwofba5.elf PID: 6206, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: jwwofba5.elf PID: 6210, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.spre.troj.evad.linELF@0/81@56/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 6458)	File: /proc/6458/mounts	Jump to behavior
Source: /bin/fusermount (PID: 6562)	File: /proc/6562/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6611)	File: /proc/6611/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6703)	File: /proc/6703/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6710)	File: /proc/6710/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6803)	File: /proc/6803/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6810)	File: /proc/6810/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6834)	File: /proc/6834/mounts	Jump to behavior

Creates hidden files and/or directories

Source: /usr/libexec/gsd-rfkill (PID: 6214)	Directory: <invalid fd (9)>/..	Jump to behavior
Source: /usr/libexec/gsd-rfkill (PID: 6214)	Directory: <invalid fd (8)>/..	Jump to behavior
Source: /lib/systemd/systemd-hostnamed (PID: 6219)	Directory: <invalid fd (10)>/..	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:75418Q47X3M	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:75420m1Cr5K	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:76108g9JjSL	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:76152Hjn7UJ	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:76156QmyPcL	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:77006LBqZcL	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:77010PeGQuJ	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:77141FLy4WM	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:77206LhMHsL	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:77296gdl6oL	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:76652W3uzvK	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:76735azOxJN	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:775425uPzEL	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:77561WWRlWJ	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:77583j6UZ0L	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:77584BHbPHN	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:77670kpLHXJ	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:77753va1AZL	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:78858Sv5eiN	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:78949AuoQ9L	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:78247CR1NIN	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:78270zA1NnN	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:78360jNPMEM	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:78388lRl4PK	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:78389TAC5PN	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:78495G6qpvM	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:78502lpf2GL	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:78594vF5OeN	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:78617ID7SgL	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:78645xFAkdK	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:78719P2z5UM	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:78818xEy7DN	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:80971K7RPsJ	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:81014MTrRDN	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:8101608qknM	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:810515UlVzM	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:810575ubWKJ	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6477)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6477)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6477)	File: /run/systemd/seats/.#seat0WoPTCW	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 6542)	Directory: /root/.cache	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6588)	Directory: /root/.cache	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6630)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6630)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6630)	File: /run/systemd/seats/.#seat09grCax	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6718)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6718)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6718)	File: /run/systemd/seats/.#seat0EqLTga	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6718)	File: /run/systemd/users/.#127FJKPqb	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6718)	File: /run/systemd/users/.#1274yurKd	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6718)	File: /run/systemd/seats/.#seat0Rcz38b	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6718)	File: /run/systemd/users/.#12791Ag9a	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6718)	File: /run/systemd/users/.#127JHvYLc	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6718)	File: /run/systemd/users/.#127Kf5mj9	Jump to behavior
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 6801)	Directory: /var/lib/gdm3/.cache	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6784)	Directory: /var/lib/gdm3/.pam_environment	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6784)	Directory: /root/.cache	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 6793)	Directory: /root/.cache	Jump to behavior

Enumerates processes within the "proc" file system

Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/6230/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/6232/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/6231/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/6234/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/6233/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/6236/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/6235/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/6477/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/6477/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/1582/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/3088/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/3088/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/6470/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/6470/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/6470/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/230/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/230/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/110/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/110/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/231/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/231/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/111/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/111/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/232/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/232/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/1579/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/112/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/112/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/233/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/233/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/113/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/113/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/234/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/234/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/1335/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/1335/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/1698/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/114/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/114/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/235/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/235/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/1334/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/1334/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/2302/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/2302/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/115/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/115/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/236/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/236/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/116/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/116/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/237/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/237/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/117/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/117/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/118/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/118/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/910/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/910/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/910/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/910/stat	Jump to behavior

Executes commands using a shell command-line interpreter

Source: /tmp/jwwofba5.elf (PID: 6369)	Shell command executed: sh -c "ps -e -o pid,args="	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6552)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6554)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6556)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6558)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6560)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6567)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6569)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6572)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 6594)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6613)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6617)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6619)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6621)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6623)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6625)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6688)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6690)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 6790)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "	Jump to behavior

Executes the "grep" command used to find patterns in files or piped streams

Source: /bin/sh (PID: 6553)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6555)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6557)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6559)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6561)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6568)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6570)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6573)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6596)	Grep executable: /usr/bin/grep -> grep -F .utf8	Jump to behavior
Source: /bin/sh (PID: 6614)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6618)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6620)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6622)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6624)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6626)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6689)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6691)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6792)	Grep executable: /usr/bin/grep -> grep -F .utf8	Jump to behavior

Executes the "kill" or "pkill" command typically used to terminate processes

Source: /usr/share/gdm/generate-config (PID: 6575)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service			Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6693)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service			Jump to behavior

Executes the "ps" command used to list the status of processes

Source: /bin/sh (PID: 6371)

Ps executable: /usr/bin/ps -> ps -e -o pid,args=

Jump to behavior

Reads system information from the proc file system

Source: /usr/bin/ps (PID: 6371)	Reads from proc file: /proc/meminfo			Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	Reads from proc file: /proc/meminfo			Jump to behavior

Reads system version information

Source: /sbin/agetty (PID: 6546)	Reads version info: /etc/issue	Jump to behavior
Source: /sbin/agetty (PID: 6605)	Reads version info: /etc/issue	Jump to behavior
Source: /sbin/agetty (PID: 6704)	Reads version info: /etc/issue	Jump to behavior

Sample tries to set the executable flag

Source: /usr/sbin/gdm3 (PID: 6584)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6584)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6588)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6588)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6780)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6780)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6784)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6784)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)	Jump to behavior

Source: /usr/sbin/rsyslogd (PID: 6472)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6472)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 6551)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 6604)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6604)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 6612)	Log file created: /var/log/gpu-manager.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 6698)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6708)	Log file created: /var/log/kern.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 6708)	Log file created: /var/log/auth.log	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/jwwofba5.elf (PID: 6208)

File: /tmp/jwwofba5.elf

Jump to behavior

Deletes log files

Source: /usr/bin/gpu-manager (PID: 6551)	Truncated file: /var/log/gpu-manager.log			Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6612)	Truncated file: /var/log/gpu-manager.log			Jump to behavior

Reads CPU information from /sys indicative of miner or evasive malware

Source: /usr/bin/ps (PID: 6371)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6470)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6575)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6693)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6835)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Uses the "uname" system call to query kernel version information (possible evasion)

Source: /tmp/jwwofba5.elf (PID: 6206)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-hostnamed (PID: 6219)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6470)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6472)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6546)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6551)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6604)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6605)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6612)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6698)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6704)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6708)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6797)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6835)	Queries kernel information via 'uname':

Source: jwwofba5.elf, 6206.1.00007ffd34329000.00007ffd3434a000.rw-.sdmp, jwwofba5.elf, 6210.1.00007ffd34329000.00007ffd3434a000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/jwwofba5.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/jwwofba5.elf
Source: kern.log.41.dr	Binary or memory string: Nov 21 18:48:56 galassia kernel: [ 482.292819] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 12/12/2018
Source: jwwofba5.elf, 6206.1.00007ffd34329000.00007ffd3434a000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.n2UK6r
Source: kern.log.41.dr	Binary or memory string: Nov 21 18:48:56 galassia kernel: [ 482.292799] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel drm parport_pc ppdev lp parport ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper psmouse ahci mptspi vmxnet3 scsi_transport_spi mptscsih libahci mptbase
Source: jwwofba5.elf, 6206.1.0000555e30b2e000.0000555e30c5c000.rw-.sdmp, jwwofba5.elf, 6210.1.0000555e30b2e000.0000555e30c5c000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: jwwofba5.elf, 6206.1.00007ffd34329000.00007ffd3434a000.rw-.sdmp, jwwofba5.elf, 6210.1.00007ffd34329000.00007ffd3434a000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: jwwofba5.elf, 6206.1.0000555e30b2e000.0000555e30c5c000.rw-.sdmp, jwwofba5.elf, 6210.1.0000555e30b2e000.0000555e30c5c000.rw-.sdmp	Binary or memory string: 0^U!/etc/qemu-binfmt/arm
Source: jwwofba5.elf, 6206.1.00007ffd34329000.00007ffd3434a000.rw-.sdmp	Binary or memory string: -^U/tmp/qemu-open.n2UK6r:
Source: jwwofba5.elf, 6210.1.00007ffd34329000.00007ffd3434a000.rw-.sdmp	Binary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 6588)	Logged in records file read: /var/log/wtmp			Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6784)	Logged in records file read: /var/log/wtmp			Jump to behavior

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: jwwofba5.elf, type: SAMPLE
Source: Yara match	File source: 6206.1.00007ff428017000.00007ff428039000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6210.1.00007ff428017000.00007ff428039000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: jwwofba5.elf PID: 6206, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: jwwofba5.elf PID: 6210, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: jwwofba5.elf, type: SAMPLE
Source: Yara match	File source: 6206.1.00007ff428017000.00007ff428039000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6210.1.00007ff428017000.00007ff428039000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: jwwofba5.elf PID: 6206, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: jwwofba5.elf PID: 6210, type: MEMORYSTR

Screenshots

No Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
162.213.35.25	unknown	United States	41231	CANONICAL-ASGB	false
89.190.156.145	unknown	United Kingdom	7489	HOSTUS-GLOBAL-ASHostUSHK	false
154.216.16.109	ksdjwi.eye-network.ru	Seychelles	135357	SKHT-ASShenzhenKatherineHengTechnologyInformationCo	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Contacted Domains

Name	IP	Active
daisy.ubuntu.com	162.213.35.24	true
ksdjwi.eye-network.ru	154.216.16.109	true
ksdjwi.eye-network.ru. [malformed]	unknown	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://daisy.ubuntu.com/9aadafe2051348cd32033e1cad68f0a5fe46fba3240ac1e6e42158f31b8a1371790c09baf3996b4979fe8e533446c7dedf30f654c68b25357334c66911dc6a9e	false		high

AV Detection

Antivirus / Scanner detection for submitted sample

Source: jwwofba5.elf

Avira: detected

Multi AV Scanner detection for submitted file

Source: jwwofba5.elf

ReversingLabs: Detection: 52%

Reads CPU information from /sys indicative of miner or evasive malware

Source: /usr/bin/ps (PID: 6371)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6470)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6575)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6693)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6835)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Found strings indicative of a multi-platform dropper

Source: jwwofba5.elf

String: EOF/proc//proc/%s/cmdlinewgetcurlftpechokillbashrebootshutdownhaltpoweroff[locker] killed process: %s ;; pid: %d

Networking

Sends malformed DNS queries

Source: global traffic

DNS traffic detected: malformed DNS query: ksdjwi.eye-network.ru. [malformed]

Detected TCP or UDP traffic on non-standard ports

Source: global traffic	TCP traffic: 192.168.2.23:50010 -> 89.190.156.145:7733
Source: global traffic	TCP traffic: 192.168.2.23:49656 -> 154.216.16.109:33966

HTTP GET or POST without a user agent

Source: global traffic

Reads the 'hosts' file potentially containing internal network hosts

Source: /usr/sbin/rsyslogd (PID: 6472)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6604)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6698)	Reads hosts file: /etc/hosts	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6708)	Reads hosts file: /etc/hosts	Jump to behavior

Sample listens on a socket

Source: /lib/systemd/systemd-journald (PID: 6448)	Socket: unknown address family	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6584)	Socket: unknown address family	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6780)	Socket: unknown address family	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6803)	Socket: unknown address family	Jump to behavior

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145
Source: unknown	TCP traffic detected without corresponding DNS query: 89.190.156.145

Source: global traffic	DNS traffic detected: DNS query: ksdjwi.eye-network.ru
Source: global traffic	DNS traffic detected: DNS query: ksdjwi.eye-network.ru. [malformed]
Source: global traffic	DNS traffic detected: DNS query: daisy.ubuntu.com

Source: unknown

Source: syslog.41.dr, syslog.171.dr, syslog.177.dr, syslog.121.dr

String found in binary or memory: https://www.rsyslog.com

Source: unknown	Network traffic detected: HTTP traffic on port 53816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 53816
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: jwwofba5.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6206.1.00007ff428017000.00007ff428039000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: 6210.1.00007ff428017000.00007ff428039000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: jwwofba5.elf PID: 6206, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown
Source: Process Memory Space: jwwofba5.elf PID: 6210, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c Author: unknown

Sample tries to kill a massive number of system processes

Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 2, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 3, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 4, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 6, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 9, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 10, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 11, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 12, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 13, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 14, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 15, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 16, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 17, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 18, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 20, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 21, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 22, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 23, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 24, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 25, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 26, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 27, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 28, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 29, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 30, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 35, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 77, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 78, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 79, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 80, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 81, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 82, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 83, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 84, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 85, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 88, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 89, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 91, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 92, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 93, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 94, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 95, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 96, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 97, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 98, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 99, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 100, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 101, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 102, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 103, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 104, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 105, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 106, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 107, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 108, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 109, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 110, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 111, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 112, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 113, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 114, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 115, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 116, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 117, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 118, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 119, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 120, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 121, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 122, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 123, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 124, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 125, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 126, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 127, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 128, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 130, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 132, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 141, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 144, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 157, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 201, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 202, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 203, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 204, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 205, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 206, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 207, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 208, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 209, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 210, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 211, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 212, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 213, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 214, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 215, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 216, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 217, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 218, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 219, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 220, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 221, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 222, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 223, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 224, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 225, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 226, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 227, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 228, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 229, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 230, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 231, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 232, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 233, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 234, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 235, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 236, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 237, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 243, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 248, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 249, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 250, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 251, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 252, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 253, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 254, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 255, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 256, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 257, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 258, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 259, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 260, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 261, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 262, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 263, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 264, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 265, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 266, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 267, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 269, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 270, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 272, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 274, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 278, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 281, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 286, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 322, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 324, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 326, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 327, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 328, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 333, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 346, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 379, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 419, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 420, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 491, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 517, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 654, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 655, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 656, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 657, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 658, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 667, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 670, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 674, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 675, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 676, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 677, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 720, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 721, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 759, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 761, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 772, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 774, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 777, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 785, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 788, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 789, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 793, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 796, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 797, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 799, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 800, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 801, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 847, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 884, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 896, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 904, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 910, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 912, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 918, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent to PID below 1000: pid: 936, result: successful	Jump to behavior

Sample tries to kill multiple processes (SIGKILL)

Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1638, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6214, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 141, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 144, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 157, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 201, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 208, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 209, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 210, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 211, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 212, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 213, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 214, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 215, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 217, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 218, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 278, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 281, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 286, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 333, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 346, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 379, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 420, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 517, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 654, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 655, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 656, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 657, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 667, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 670, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 675, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 677, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 788, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 789, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 796, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 797, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 799, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 800, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 801, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 847, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 884, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 896, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 904, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 910, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 912, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 918, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1207, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1320, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1349, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1599, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1699, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1809, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1877, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1888, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1890, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1900, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1983, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2009, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2014, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2018, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2025, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2028, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2033, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2038, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2050, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2062, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2063, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2069, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2074, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2077, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2078, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2079, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2080, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2083, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2084, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2096, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2097, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2102, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2114, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2123, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2126, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2128, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2129, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2146, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2156, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2180, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2195, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2208, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2223, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2226, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2235, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2242, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2275, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2281, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2285, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2289, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2294, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2302, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2307, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2637, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2746, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2749, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2761, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2882, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 3021, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 3088, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 3236, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 4443, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 4444, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 4445, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 4446, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 4472, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 4477, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 4496, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6034, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6151, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6158, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6161, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6180, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6181, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6190, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6191, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6219, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6221, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6222, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6223, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6224, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6225, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6226, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6227, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6228, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6229, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6230, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6231, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6232, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6233, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6234, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6235, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6236, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6237, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6369, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6371, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6458, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6470, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6472, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6546, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6584, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6603, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6604, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6605, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6609, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6611, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6697, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6697, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6698, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6702, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6703, result: successful	Jump to behavior

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Source: Initial sample	String containing 'busybox' found: BusyBox
Source: Initial sample	String containing 'busybox' found: BusyBoxps:/proc/%d/exe[killer/exe] killed process: %s ;; pid: %d

Sample has stripped symbol table

Source: ELF static info symbol of initial sample

.symtab present: no

Sample tries to kill a process (SIGKILL)

Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1638, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6214, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 3, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 4, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 9, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 10, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 11, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 12, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 13, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 14, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 15, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 16, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 17, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 18, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 20, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 21, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 22, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 23, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 24, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 25, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 26, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 27, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 28, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 29, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 30, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 35, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 77, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 78, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 79, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 80, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 81, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 82, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 83, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 84, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 85, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 88, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 89, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 91, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 92, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 93, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 94, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 95, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 96, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 97, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 98, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 99, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 100, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 101, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 102, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 103, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 104, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 105, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 106, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 107, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 108, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 109, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 110, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 111, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 112, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 113, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 114, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 115, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 116, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 117, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 118, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 119, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 120, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 121, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 122, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 123, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 124, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 125, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 126, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 127, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 128, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 130, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 132, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 141, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 144, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 157, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 201, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 202, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 203, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 204, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 205, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 206, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 207, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 208, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 209, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 210, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 211, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 212, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 213, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 214, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 215, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 216, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 217, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 218, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 219, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 220, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 221, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 222, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 223, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 224, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 225, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 226, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 227, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 228, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 229, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 230, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 231, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 232, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 233, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 234, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 235, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 236, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 237, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 243, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 248, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 249, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 250, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 251, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 252, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 253, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 254, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 255, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 256, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 257, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 258, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 259, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 260, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 261, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 262, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 263, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 264, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 265, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 266, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 267, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 269, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 270, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 272, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 274, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 278, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 281, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 286, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 322, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 324, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 326, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 327, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 328, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 333, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 346, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 379, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 419, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 420, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 491, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 517, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 654, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 655, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 656, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 657, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 658, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 667, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 670, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 674, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 675, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 676, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 677, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 720, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 721, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 759, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 761, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 772, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 774, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 777, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 785, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 788, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 789, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 793, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 796, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 797, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 799, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 800, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 801, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 847, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 884, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 896, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 904, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 910, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 912, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 918, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 936, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1207, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1320, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1334, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1335, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1344, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1349, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1599, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1699, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1809, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1860, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1872, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1877, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1886, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1888, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1890, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1900, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 1983, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2009, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2014, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2018, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2025, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2028, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2033, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2038, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2048, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2050, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2062, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2063, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2069, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2074, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2077, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2078, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2079, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2080, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2083, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2084, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2096, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2097, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2102, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2114, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2123, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2126, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2128, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2129, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2146, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2156, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2180, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2195, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2208, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2223, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2226, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2235, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2242, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2275, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2281, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2285, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2289, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2294, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2302, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2307, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2637, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2746, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2749, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2761, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 2882, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 3021, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 3088, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 3236, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 4443, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 4444, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 4445, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 4446, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 4472, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 4477, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 4496, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6034, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6151, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6158, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6161, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6180, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6181, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6190, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6191, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6219, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6221, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6222, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6223, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6224, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6225, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6226, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6227, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6228, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6229, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6230, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6231, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6232, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6233, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6234, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6235, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6236, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6237, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6369, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6371, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6458, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6470, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6472, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6546, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6584, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6603, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6604, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6605, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6609, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6611, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6697, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6697, result: no such process	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6698, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6702, result: successful	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	SIGKILL sent: pid: 6703, result: successful	Jump to behavior

Yara signature match

Source: jwwofba5.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6206.1.00007ff428017000.00007ff428039000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: 6210.1.00007ff428017000.00007ff428039000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: jwwofba5.elf PID: 6206, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16
Source: Process Memory Space: jwwofba5.elf PID: 6210, type: MEMORYSTR	Matched rule: Linux_Trojan_Gafgyt_28a2fe0c os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = a2c6beaec18ca876e8487c11bcc7a29279669588aacb7d3027d8d8df8f5bcead, id = 28a2fe0c-eed5-4c79-81e6-3b11b73a4ebd, last_modified = 2021-09-16

Source: classification engine

Classification label: mal100.spre.troj.evad.linELF@0/81@56/0

Persistence and Installation Behavior

Sample reads /proc/mounts (often used for finding a writable filesystem)

Source: /usr/bin/dbus-daemon (PID: 6458)	File: /proc/6458/mounts	Jump to behavior
Source: /bin/fusermount (PID: 6562)	File: /proc/6562/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6611)	File: /proc/6611/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6703)	File: /proc/6703/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6710)	File: /proc/6710/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6803)	File: /proc/6803/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6810)	File: /proc/6810/mounts	Jump to behavior
Source: /usr/bin/dbus-daemon (PID: 6834)	File: /proc/6834/mounts	Jump to behavior

Creates hidden files and/or directories

Source: /usr/libexec/gsd-rfkill (PID: 6214)	Directory: <invalid fd (9)>/..	Jump to behavior
Source: /usr/libexec/gsd-rfkill (PID: 6214)	Directory: <invalid fd (8)>/..	Jump to behavior
Source: /lib/systemd/systemd-hostnamed (PID: 6219)	Directory: <invalid fd (10)>/..	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:75418Q47X3M	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:75420m1Cr5K	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:76108g9JjSL	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:76152Hjn7UJ	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:76156QmyPcL	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:77006LBqZcL	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:77010PeGQuJ	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:77141FLy4WM	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:77206LhMHsL	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:77296gdl6oL	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:76652W3uzvK	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:76735azOxJN	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:775425uPzEL	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:77561WWRlWJ	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:77583j6UZ0L	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:77584BHbPHN	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:77670kpLHXJ	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:77753va1AZL	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:78858Sv5eiN	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:78949AuoQ9L	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:78247CR1NIN	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:78270zA1NnN	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:78360jNPMEM	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:78388lRl4PK	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:78389TAC5PN	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:78495G6qpvM	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:78502lpf2GL	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:78594vF5OeN	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:78617ID7SgL	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:78645xFAkdK	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:78719P2z5UM	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:78818xEy7DN	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:80971K7RPsJ	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:81014MTrRDN	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:8101608qknM	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:810515UlVzM	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	File: /run/systemd/journal/streams/.#9:810575ubWKJ	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6477)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6477)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6477)	File: /run/systemd/seats/.#seat0WoPTCW	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 6542)	Directory: /root/.cache	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6588)	Directory: /root/.cache	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6630)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6630)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6630)	File: /run/systemd/seats/.#seat09grCax	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6718)	Directory: <invalid fd (18)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6718)	Directory: <invalid fd (17)>/..	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6718)	File: /run/systemd/seats/.#seat0EqLTga	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6718)	File: /run/systemd/users/.#127FJKPqb	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6718)	File: /run/systemd/users/.#1274yurKd	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6718)	File: /run/systemd/seats/.#seat0Rcz38b	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6718)	File: /run/systemd/users/.#12791Ag9a	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6718)	File: /run/systemd/users/.#127JHvYLc	Jump to behavior
Source: /lib/systemd/systemd-logind (PID: 6718)	File: /run/systemd/users/.#127Kf5mj9	Jump to behavior
Source: /usr/lib/gdm3/gdm-wayland-session (PID: 6801)	Directory: /var/lib/gdm3/.cache	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6784)	Directory: /var/lib/gdm3/.pam_environment	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6784)	Directory: /root/.cache	Jump to behavior
Source: /usr/lib/policykit-1/polkitd (PID: 6793)	Directory: /root/.cache	Jump to behavior

Enumerates processes within the "proc" file system

Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/6230/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/6232/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/6231/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/6234/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/6233/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/6236/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/6235/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/6477/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/6477/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/1582/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/3088/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/3088/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/6470/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/6470/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/6470/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/230/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/230/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/230/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/110/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/110/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/110/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/231/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/231/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/231/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/111/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/111/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/111/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/232/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/232/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/232/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/1579/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/112/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/112/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/112/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/233/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/233/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/233/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/113/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/113/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/113/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/234/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/234/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/234/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/1335/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/1335/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/1698/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/114/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/114/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/114/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/235/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/235/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/235/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/1334/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/1334/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/2302/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/2302/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/115/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/115/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/115/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/236/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/236/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/236/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/116/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/116/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/116/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/237/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/237/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/237/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/117/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/117/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/117/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/118/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/118/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/118/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/910/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/910/stat	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/910/cmdline	Jump to behavior
Source: /tmp/jwwofba5.elf (PID: 6210)	File opened: /proc/910/stat	Jump to behavior

Executes commands using a shell command-line interpreter

Source: /tmp/jwwofba5.elf (PID: 6369)	Shell command executed: sh -c "ps -e -o pid,args="	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6552)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6554)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6556)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6558)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6560)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6567)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6569)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6572)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 6594)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6613)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6617)	Shell command executed: sh -c "grep -G \"^blacklist.nvidia[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6619)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6621)	Shell command executed: sh -c "grep -G \"^blacklist.radeon[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6623)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6625)	Shell command executed: sh -c "grep -G \"^blacklist.amdgpu[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6688)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /etc/modprobe.d/*.conf"	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6690)	Shell command executed: sh -c "grep -G \"^blacklist.nouveau[[:space:]]$\" /lib/modprobe.d/*.conf"	Jump to behavior
Source: /usr/share/language-tools/language-options (PID: 6790)	Shell command executed: sh -c "locale -a \| grep -F .utf8 "	Jump to behavior

Executes the "grep" command used to find patterns in files or piped streams

Source: /bin/sh (PID: 6553)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6555)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6557)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6559)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6561)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6568)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6570)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6573)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6596)	Grep executable: /usr/bin/grep -> grep -F .utf8	Jump to behavior
Source: /bin/sh (PID: 6614)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6618)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nvidia[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6620)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6622)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.radeon[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6624)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6626)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.amdgpu[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6689)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /etc/modprobe.d/alsa-base.conf /etc/modprobe.d/amd64-microcode-blacklist.conf /etc/modprobe.d/blacklist-ath_pci.conf /etc/modprobe.d/blacklist-firewire.conf /etc/modprobe.d/blacklist-framebuffer.conf /etc/modprobe.d/blacklist-modem.conf /etc/modprobe.d/blacklist-oss.conf /etc/modprobe.d/blacklist-rare-network.conf /etc/modprobe.d/blacklist.conf /etc/modprobe.d/intel-microcode-blacklist.conf /etc/modprobe.d/iwlwifi.conf /etc/modprobe.d/mdadm.conf	Jump to behavior
Source: /bin/sh (PID: 6691)	Grep executable: /usr/bin/grep -> grep -G ^blacklist.nouveau[[:space:]]$ /lib/modprobe.d/aliases.conf /lib/modprobe.d/blacklist_linux_5.4.0-72-generic.conf /lib/modprobe.d/blacklist_linux_5.4.0-81-generic.conf /lib/modprobe.d/fbdev-blacklist.conf /lib/modprobe.d/systemd.conf	Jump to behavior
Source: /bin/sh (PID: 6792)	Grep executable: /usr/bin/grep -> grep -F .utf8	Jump to behavior

Executes the "kill" or "pkill" command typically used to terminate processes

Source: /usr/share/gdm/generate-config (PID: 6575)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service			Jump to behavior
Source: /usr/share/gdm/generate-config (PID: 6693)	Pkill executable: /usr/bin/pkill -> pkill --signal HUP --uid gdm dconf-service			Jump to behavior

Executes the "ps" command used to list the status of processes

Source: /bin/sh (PID: 6371)

Ps executable: /usr/bin/ps -> ps -e -o pid,args=

Jump to behavior

Reads system information from the proc file system

Source: /usr/bin/ps (PID: 6371)	Reads from proc file: /proc/meminfo			Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	Reads from proc file: /proc/meminfo			Jump to behavior

Reads system version information

Source: /sbin/agetty (PID: 6546)	Reads version info: /etc/issue	Jump to behavior
Source: /sbin/agetty (PID: 6605)	Reads version info: /etc/issue	Jump to behavior
Source: /sbin/agetty (PID: 6704)	Reads version info: /etc/issue	Jump to behavior

Sample tries to set the executable flag

Source: /usr/sbin/gdm3 (PID: 6584)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6584)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6588)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6588)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6780)	File: /var/run/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/sbin/gdm3 (PID: 6780)	File: /var/log/gdm3 (bits: - usr: -x grp: x all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6784)	File: /var/lib/AccountsService/icons (bits: - usr: rx grp: rwx all: rwx)	Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6784)	File: /var/lib/AccountsService/users (bits: - usr: - grp: - all: rwx)	Jump to behavior

Source: /usr/sbin/rsyslogd (PID: 6472)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6472)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 6551)	Log file created: /var/log/gpu-manager.log
Source: /usr/sbin/rsyslogd (PID: 6604)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6604)	Log file created: /var/log/auth.log
Source: /usr/bin/gpu-manager (PID: 6612)	Log file created: /var/log/gpu-manager.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 6698)	Log file created: /var/log/kern.log
Source: /usr/sbin/rsyslogd (PID: 6708)	Log file created: /var/log/kern.log	Jump to dropped file
Source: /usr/sbin/rsyslogd (PID: 6708)	Log file created: /var/log/auth.log	Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/jwwofba5.elf (PID: 6208)

File: /tmp/jwwofba5.elf

Jump to behavior

Deletes log files

Source: /usr/bin/gpu-manager (PID: 6551)	Truncated file: /var/log/gpu-manager.log			Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6612)	Truncated file: /var/log/gpu-manager.log			Jump to behavior

Reads CPU information from /sys indicative of miner or evasive malware

Source: /usr/bin/ps (PID: 6371)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6470)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6575)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6693)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6835)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Uses the "uname" system call to query kernel version information (possible evasion)

Source: /tmp/jwwofba5.elf (PID: 6206)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-hostnamed (PID: 6219)	Queries kernel information via 'uname':	Jump to behavior
Source: /lib/systemd/systemd-journald (PID: 6448)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6470)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6472)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6546)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6551)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6604)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6605)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/gpu-manager (PID: 6612)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6698)	Queries kernel information via 'uname':	Jump to behavior
Source: /sbin/agetty (PID: 6704)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/sbin/rsyslogd (PID: 6708)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/lib/gdm3/gdm-session-worker (PID: 6797)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/pulseaudio (PID: 6835)	Queries kernel information via 'uname':

Source: jwwofba5.elf, 6206.1.00007ffd34329000.00007ffd3434a000.rw-.sdmp, jwwofba5.elf, 6210.1.00007ffd34329000.00007ffd3434a000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-arm/tmp/jwwofba5.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/jwwofba5.elf
Source: kern.log.41.dr	Binary or memory string: Nov 21 18:48:56 galassia kernel: [ 482.292819] Hardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 12/12/2018
Source: jwwofba5.elf, 6206.1.00007ffd34329000.00007ffd3434a000.rw-.sdmp	Binary or memory string: /tmp/qemu-open.n2UK6r
Source: kern.log.41.dr	Binary or memory string: Nov 21 18:48:56 galassia kernel: [ 482.292799] Modules linked in: monitor(OE) md4 cmac cifs libarc4 fscache libdes vmw_vsock_vmci_transport vsock binfmt_misc dm_multipath scsi_dh_rdac scsi_dh_emc scsi_dh_alua vmw_balloon joydev input_leds serio_raw vmw_vmci sch_fq_codel drm parport_pc ppdev lp parport ip_tables x_tables autofs4 btrfs zstd_compress raid10 raid456 async_raid6_recov async_memcpy async_pq async_xor async_tx xor raid6_pq libcrc32c raid1 raid0 multipath linear crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel crypto_simd cryptd glue_helper psmouse ahci mptspi vmxnet3 scsi_transport_spi mptscsih libahci mptbase
Source: jwwofba5.elf, 6206.1.0000555e30b2e000.0000555e30c5c000.rw-.sdmp, jwwofba5.elf, 6210.1.0000555e30b2e000.0000555e30c5c000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/arm
Source: jwwofba5.elf, 6206.1.00007ffd34329000.00007ffd3434a000.rw-.sdmp, jwwofba5.elf, 6210.1.00007ffd34329000.00007ffd3434a000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-arm
Source: jwwofba5.elf, 6206.1.0000555e30b2e000.0000555e30c5c000.rw-.sdmp, jwwofba5.elf, 6210.1.0000555e30b2e000.0000555e30c5c000.rw-.sdmp	Binary or memory string: 0^U!/etc/qemu-binfmt/arm
Source: jwwofba5.elf, 6206.1.00007ffd34329000.00007ffd3434a000.rw-.sdmp	Binary or memory string: -^U/tmp/qemu-open.n2UK6r:
Source: jwwofba5.elf, 6210.1.00007ffd34329000.00007ffd3434a000.rw-.sdmp	Binary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped

Language, Device and Operating System Detection

Reads system files that contain records of logged in users

Source: /usr/lib/accountsservice/accounts-daemon (PID: 6588)	Logged in records file read: /var/log/wtmp			Jump to behavior
Source: /usr/lib/accountsservice/accounts-daemon (PID: 6784)	Logged in records file read: /var/log/wtmp			Jump to behavior

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: jwwofba5.elf, type: SAMPLE
Source: Yara match	File source: 6206.1.00007ff428017000.00007ff428039000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6210.1.00007ff428017000.00007ff428039000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: jwwofba5.elf PID: 6206, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: jwwofba5.elf PID: 6210, type: MEMORYSTR

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: jwwofba5.elf, type: SAMPLE
Source: Yara match	File source: 6206.1.00007ff428017000.00007ff428039000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6210.1.00007ff428017000.00007ff428039000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: jwwofba5.elf PID: 6206, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: jwwofba5.elf PID: 6210, type: MEMORYSTR

ID:	1560606
Product:	CloudBasic
Start time:	01:47:04
Start date:	22.11.2024
Sample:	jwwofba5.elf
Cookbook:	defaultlinuxfilecookbook.jbs
System description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Architecture:	LINUX
MD5:	17da38e07a65cc00570a50987d817045
SHA1:	d37454e19f8228bf8c623b6d11e32aedf6f369be
SHA256:	8e7c6f27872f3305dc63a9dd244e6b2027d458d1e725cbc6104afc392d3fc1ee
Filetype:	ELF Executable and Linkable format (generic) (4004/1) 100.00%

Name	Type	MD5	SHA1	SHA256
/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-sink	ASCII text	FF001A15CE15CF062A3704CEA2991B5F	B06F6855F376C3245B82212AC73ADED55DFE5DEF	C54830B41ECFA1B6FBDC30397188DDA86B7B200E62AEAC21AE694A6192DCC38A
/home/saturnino/.config/pulse/ee49dfd4fa47433baee88884e2d7de7c-default-source	ASCII text	28FE6435F34B3367707BB1C5D5F6B430	EB8FE2D16BD6BBCCE106C94E4D284543B2573CF6	721A37C69E555799B41D308849E8F8125441883AB021B723FED90A9B744F36C0
/proc/6808/oom_score_adj	very short file (no magic)	CFCD208495D565EF66E7DFF9F98764DA	B6589FC6AB0DC82CF12099D1C2D40AB994E8410C	5FECEB66FFC86F38D952786C6D696C79C2DBC239DD4E91B46729D73A27FB57E9
/run/gdm3.pid	ASCII text	A5955FA627AB233994A4CEE8B5A8172F	1994467AFF25375B6B1357B316137603A7E34BBE	5CE6DC66DA81C6758B8D8A72C5CAC3D23B98748CA3ADEF358A8D19FE8191E396
/run/systemd/journal/streams/.#9:75418Q47X3M	ASCII text	44646D211FCCDF14FC55A9CF91D9E900	73B7ED3AB4682B41EE6ABEE86E44CFB40417BDD4	8CF671B8608EB0D3D8F2C2096AB3E3CD592B757405E470C0D4ECE88ED226AA55
/run/systemd/journal/streams/.#9:75420m1Cr5K	ASCII text	D3735D1F3F8ED9CAD0F8461ACA86F417	25B52CE308AFDEE76A45452391D59CC2596DD017	57D2A535B27F17CD3AB4917184BF1A838F18A10A951E4FF342463BAAC83AF36A
/run/systemd/journal/streams/.#9:76108g9JjSL	ASCII text	1B8FF49F5A89EE664E28C84992DE6795	8219421E89655D6B4E9C4271293AC178D376582C	1FF0B799626AB02F1D3B72E9FB55BFD74CBB559CFF96C427E1BD9B0601764448
/run/systemd/journal/streams/.#9:76152Hjn7UJ	ASCII text	80892F4AAAA69DBD1BF6F6EC4665DBA4	5EDB5E305CE48F2E6D769550EEB8A43A9C2E7AD3	A39A5A7B95C3B3D2F73A2E9077BAD769EFAB0A8C41E7AA613D3768A6AFEFA5DE
/run/systemd/journal/streams/.#9:76156QmyPcL	ASCII text	3C87C438BF99AB31A710FFDBDEA47406	AE527BA3D53FA7C91D5089A60FDA28A44EBA52E4	3DD9B0DF5086B616D1E11B449C679CA455540F6C92A36866DF6BFA467B4E9766
/run/systemd/journal/streams/.#9:76652W3uzvK	ASCII text	41920C7C46E750F80D45B493B43F6768	8C32855356ABF486FE5A8FBBDF98AE6DC5B908B4	DD5AAD982D9CF1723D44697B9C99D62FF67CD174598D96731DA96CB09E9074D5
/run/systemd/journal/streams/.#9:76735azOxJN	ASCII text	34BCBC4166F2EA955FA2E2D7C892582A	0BB7D7647F1A2890129CE2B6318CB8CAEB5105B7	440441F34C4B7232618B0F6EC4631722BC4D04A8C58179E88934F775DE495E0F
/run/systemd/journal/streams/.#9:77006LBqZcL	ASCII text	A8D593F47F8990EF87E0B5DA0156DE2A	D80D40D3384863A2123C9BE422140E20D6036AE0	6FACDAFF56F317E71256CD1AF6A3C44A5420DB30631B9863E244CD304BB6951E
/run/systemd/journal/streams/.#9:77010PeGQuJ	ASCII text	16AAED71F82539F861FAAD4676FB9965	2D39B2B112507143437187CC6F12EE689BE0A932	566FFC5197F085B8A3C1C43F11D733164750E2A78B7016C81833F2CFE998DE44
/run/systemd/journal/streams/.#9:77141FLy4WM	ASCII text	7E4787176713194BD40C358CAB07223D	E5E8500E5AA5B7279A6ABFC666A06D3DE21CAAF7	3B096B8ABC280884E5185C3CE6971276470ACB2E2154CC132307F484F57BF0D7
/run/systemd/journal/streams/.#9:77206LhMHsL	ASCII text	941D5736EBBBF1CA12797CD83E9EB4FE	71EC2659CB67A13C3B1D1F5E268F50ABA26DFEE9	42E5BEA9232D34FE68BF36431FFEA06AA0C0D54F0FF41E2389922177ED9B43DC
/run/systemd/journal/streams/.#9:77296gdl6oL	ASCII text	17C33AE18A07F8A42C9A7413A18C789F	67C37E2AB861065557C90BA60ED2DB3A77EAF8EB	99ACB1063B0C66DD84916878382E99B9F2B8F04EAA9B040CFF90227A8726ADAE
/run/systemd/journal/streams/.#9:775425uPzEL	ASCII text	2EB3711C140FE2954DD98B41444A980A	699059F724ECA8D4371A147C1582016EBC1208CE	FC3D8A491D228C7982B086E30785F0C1B9288D6CE70563FB47D4DAB998AE0161
/run/systemd/journal/streams/.#9:77561WWRlWJ	ASCII text	898F112023E17E0858A49D353FCD7181	100715C31E1E975DE7AC68CEB5934E9E96FFFB4F	2D3100C97D0F0432C9FBA149B77D2CE006E4B6704AD09B1A78D047F182F210F7
/run/systemd/journal/streams/.#9:77583j6UZ0L	ASCII text	0A63958E9D54F6A9EF927E149DD69A4D	D513B2F0AFF346CE3D28671D7EEFDA8A7B30C7F6	22CC2B70B6E2FD8C48D5F06F792360221320104A46DF7EDD480111F9BDFC478C
/run/systemd/journal/streams/.#9:77584BHbPHN	ASCII text	148DDE17598CB0BBDAC36DABAA651D29	D6F2ACCB816FE36BA112CF37420D600549D457FD	575CA1A3E769FD67400C8D043FF2056F7EECAB30D720D7436C2F059620B8ADB1
/run/systemd/journal/streams/.#9:77670kpLHXJ	ASCII text	39439E3BE33393C16D06FE37EAEBBBA7	C597C15BCD3EA74B25FAFA417069A1A3DE02D80A	C0A65AD76656E3E5575FFA2E71E31556298EE4AE80CAFF7AF81FD9C4FD80FE55
/run/systemd/journal/streams/.#9:77753va1AZL	ASCII text	3B746E9338E92C71E8D4A0902666162F	5D078077B87B2A41BC5F4156DA4862F2E89574D7	F2D4734B7C035FFBD797E3FDAEB82EBD7F65BF5CB4F6296675A951EA88AF551D
/run/systemd/journal/streams/.#9:78247CR1NIN	ASCII text	AE77C3A0EB05E39AC76C3B537AB83FAC	E2A0A46E377A0B231BEE1FD46BD3B436A1FF8907	D02A6597BD96381A40F2413B4479B7FCD69929024F5F78B825AFC09BE446E7DF
/run/systemd/journal/streams/.#9:78270zA1NnN	ASCII text	1E24CC75C5E3B3079CA473C62AE113C2	92A217E4BEFF7E69091CED992EE2871B30E04756	D84DAA9D15A37EEC68DF70A492E3936BBE2067E142D26EA5F785C0A6F090B706
/run/systemd/journal/streams/.#9:78360jNPMEM	ASCII text	25172AE8285D8C9284DC207112562E65	C025F9065E167D73FC0C0F9869B19F3736110193	9ECCB1AF5D2A5ED3CB7C6DB2562148BCAF5EC3BDC7E6B869DFFA575D14C9EFFF
/run/systemd/journal/streams/.#9:78388lRl4PK	ASCII text	3C860A3C0CE8158D79D2703D9746E6D3	697008E05918F4F76843939D3175565D6A8B7A28	C844791F5199FF3DD698876D2500E72164B4E9CA21FBCE8B247C1E946FC56794
/run/systemd/journal/streams/.#9:78389TAC5PN	ASCII text	70A87399B2F27458B9933C01F2AADC86	3CC35457AE0DBDD1484BF78AB05381AE44028CFC	A33B85197D61C2CB8F8E08A8F00B508D9486EF130693B5D753CA5BF6785140C7
/run/systemd/journal/streams/.#9:78495G6qpvM	ASCII text	3217BEAD22706673A2DA71C18E578E32	4727F190F84F0B34C77A2AD3495E55428F358BD1	078A7546DFDC68594D747ECE1F51E7C5C618F75DF430E5495BA4FB4034050BAF
/run/systemd/journal/streams/.#9:78502lpf2GL	ASCII text	2A77EB341BFB6B7EB61AFEB7748CBC94	FE4F819DBDBFB7E369C4A5AE634000B6EEED5071	D062B8BBB882DC54EDB3177E65B0CFA7EACAE2D39A42DCBCC796AD9E5DE70D0E
/run/systemd/journal/streams/.#9:78594vF5OeN	ASCII text	73299377503F388295EF6309700B66B2	115E3528EA2F97783B67BA7EC17DEA7429389AAD	F95FEB3041753202A8C0CBB2C6CE23F8BBA70E42F2C080FA36CDBBC80DB4F190
/run/systemd/journal/streams/.#9:78617ID7SgL	ASCII text	F33AA0484437BD68512FE4D955DAC0CF	E9D5DD51CC1DF09D3A01BFE30DBDCACBF53DE84F	C104DC19C88093D2481E3E8F56AFC5F8BF876F4FB5DADF34987AFBD06627E4F4
/run/systemd/journal/streams/.#9:78645xFAkdK	ASCII text	1625211ED475805827ECF6FE926A5ADF	F11842935164D3F6103C7F1E482265238FA0179C	B4349C2E191DE40CC50272B8519E7F3139247273F21652A8DEAC25DE953447DF
/run/systemd/journal/streams/.#9:78719P2z5UM	ASCII text	6E9A9952DF861393560CA3CA0E6223C2	68A8CE07661ED0389A6ED4087B2AAE329FE8599C	33D2117B09273F0C8B4B4ED618C3EFDB03E62AB6CED8477CE66ABCCA77A3CF62
/run/systemd/journal/streams/.#9:78818xEy7DN	ASCII text	521D8189A391E9CE78CD0287D5C9AA6B	77C83419F8C2FC2554FD50F97DC54FC5195E51D4	AB3200FDF4C588A9DBF6384AEECC0BB67657D61F0E6613226B49D078313BB92A
/run/systemd/journal/streams/.#9:78858Sv5eiN	ASCII text	F81AED91CE8C4B96F750C4832989241B	F69BE87C5CD8F2BA606AAC125AFE1A3A027BD1EB	EA4E6B80C35574A09A532C7BFCFEBF3BCD1BF81DCCC82D0BD729B56794AF0F92
/run/systemd/journal/streams/.#9:78949AuoQ9L	ASCII text	D9A3280035E4348397BD446AB5C7C77F	1F2053FF60426B5A814C93BCB4E31989BDF794F1	CF1BDF994EAA21E3E207C1747B72DEF7272F1DD116B859902AA80865309107D5
/run/systemd/journal/streams/.#9:80072KAeH6M	ASCII text	C692BA8E88E882915390F1982C93970D	E42E98AE8200F666CA9D123CD2B6C428491BC47F	0FF7CB666D51923A2DD5DC7DA3BDBA47079A918AFB25D9066461116FA7AB2AB9
/run/systemd/journal/streams/.#9:80082iBsn2L	ASCII text	5A5264C1BD32794B6BDBB99F96403285	2588C42D6976F5DFB833072B0424E9EE3A9BA88B	588E0ED3BEB2FD59FD64A599BACA6CCB39C8F7492B4E5E337676EE3462C45467
/run/systemd/journal/streams/.#9:80971K7RPsJ	ASCII text	ACF66006F0C0FB10BC9502E2617AEBD8	FEC1D3EAC6A76E7CE0EF78784EBC5644181DE351	5C2BF5303D8A23BE4B93BA52DC4D9A607ED70760D4D0F9E379AF6C03CBDB5906
/run/systemd/journal/streams/.#9:81014MTrRDN	ASCII text	E332BE4152B78D010441758AFE662BFA	CBAC7214689B2FBEB0AA5F527E64793F977F1242	4E8297A23884D904D9E41AF57A976F3A16F75F2BCC8D9BE9E60B1689B14E290A
/run/systemd/journal/streams/.#9:8101608qknM	ASCII text	6A4B99CD466ED97DCDCCC9BFB2E32D9B	1CE953DFE8C9F6998935D76262BAD52FCF790BDD	D395020D6EA7432C2E82D15E4FC37AD020FBDAED0FD4208701D2ABDA3FD548DF
/run/systemd/journal/streams/.#9:810515UlVzM	ASCII text	E8989DEDE43C5AD9601810EF25671C85	E73060CFAA77AF06A2563BDF4F3ED64C6AE5506E	EFA0E031459494D9118645C79586346EEF0335C519E4E6C84887A4D955C9CD3D
/run/systemd/journal/streams/.#9:810575ubWKJ	ASCII text	9A3460F9144235FAAB543B30E968B6FF	37D8370DBF501A4441A448D354A0D5AA1C86E0BB	DB3A370DDB20F7D7FCECC681FB16E12047F0CF5AAA3D12B6BB97D171DC1DD828
/run/systemd/journal/streams/.#9:81167hR7KAJ	ASCII text	DB74D6204F45FF004863946FFE2EBF22	2DEC00AFD58C93D2AFD353B1AA943100F1831C4C	4411347563638C2D7F0E72C0811316D4631CB6B17AF676AD60493F76EA150845
/run/systemd/seats/.#seat09grCax	ASCII text	BE58CCABC942125F5E27AF6EB1BA2F88	07C20F55E36EE48869B223B8FC4DBC227C7353AC	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
/run/systemd/seats/.#seat0EqLTga	ASCII text	BE58CCABC942125F5E27AF6EB1BA2F88	07C20F55E36EE48869B223B8FC4DBC227C7353AC	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
/run/systemd/seats/.#seat0Rcz38b	ASCII text	66D114877B3B4DB3BDD8A3AD4F5E7421	62E0CB0F51E0E3F97BE251CB917968DFF69ED344	A922628916A7DDBE2BAA33F421C82250527EA3C28E429749353A1C75C0C18860
/run/systemd/seats/.#seat0WoPTCW	ASCII text	BE58CCABC942125F5E27AF6EB1BA2F88	07C20F55E36EE48869B223B8FC4DBC227C7353AC	551B1D1C8E5953D5D0CF49C83C1568E2FBEF8BDDB69903B3DA82240B777B4629
/run/systemd/users/.#1274yurKd	ASCII text	11A05128A3CC1EF53857C26CF5DDA0AF	085582B048E0B2A8DA5D96594A4F2906446A153E	830234CBDD39B29694A1E1733F7AE7EDEBBAE6687EF455139122D11F26AF0FBC
/run/systemd/users/.#12791Ag9a	ASCII text	11A05128A3CC1EF53857C26CF5DDA0AF	085582B048E0B2A8DA5D96594A4F2906446A153E	830234CBDD39B29694A1E1733F7AE7EDEBBAE6687EF455139122D11F26AF0FBC
/run/systemd/users/.#127FJKPqb	ASCII text	065A3AD1A34A9903F536410ECA748105	21CD684DF60D569FA96EEEB66A0819EAC1B2B1A4	E80554BF0FF4E32C61D4FA3054F8EFB27A26F1C37C91AE4EA94445C400693941
/run/systemd/users/.#127JHvYLc	ASCII text	AE5E04A438D14A295ADA577FC77177EB	4B4E439BB84A999BC5ADE510037B705293EFF707	6B2FFE206325ABC47B5F4CEF723F281DA094886853976218C9EA88441AC3BEB7
/run/systemd/users/.#127Kf5mj9	ASCII text	30E2E61909A4F116417974C9D5FFF35D	861A6FA00E3E884852C737803F0E9B53F123B008	88533964BC9AE6C4BBA68B780F36BC38B03D3A22677833CDC0D81F9183559830
/run/user/1000/pulse/pid	ASCII text	B0041635638BB559C23AF84FE4A3915D	36B458C3648808F59660D48FB24299EECB136B1D	5590C8E2318E8C7AEC9C0702BD5DEFD1359EAA1C6E616DED240677A8E2D2CC86
/run/utmp	data	87FDE0927CF343DEFB230443175FDE2D	F851F7D6EC7AD1BD95CE6D2A3A6D2920EB858107	7C1F68317BDFB01D659F0086DDC59BBF125BEE66733941F8A6BC56D37016130A
/tmp/qemu-open.n2UK6r (deleted)	data	1A6398985244FAE3C6FF7BC9F9F155F1	C61D992BA5CBF27E4840EAC967479914ED72DD66	3C89BEBA0D467433C41C7937E511207C90EFD2A201A3778A9D8ED19DA31A0560
/var/lib/AccountsService/users/gdm.KBECX2	ASCII text	542BA3FB41206AE43928AF1C5E61FEBC	F56F574DAF50D609526B36B5B54FDD59EA4D6A26	730D9509D4EAA7266829A8F5A8CFEBA6BBDDD5873FC2BD580AD464F4A237E11A
/var/lib/ubuntu-drivers-common/last_gfx_boot	ASCII text	078760523943E160756979906B85FB5E	0962643266F4C5537F7D125046F28F21D6DD0C89	048416AC7A9A99690B8B53718CD39F32F637B55CC8DD8E67E58E5AEF060DD41C
/var/log/auth.log	ASCII text	8C83E5FB8E7B1FC3B1F224B4EA9AD612	3D57B84650E0459495C0F73B6AADD7362E0C766F	D5D6AFEB55C2ACB35CB23280701DBCFAE0165C3B8BB806889ECCA404A14BE281
/var/log/gpu-manager.log	ASCII text	3AF77E630DA00B3BE24F4E8AA5D78B13	BCF2D99E002F6DE2413A183227B011CFBEF5673D	EB1CBBA20845237B4409274D693FEAE13F835274DA3337B7A9D14F4D7FDF9DEA
/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/system.journal	data	17BFCB64E56A855723A3893CF1E68DD2	00948F6F75E5DAAB14F99763F69476DD6CB37CD0	9670C7E6990636643889114F1E114D867624AEF17750B1D2BC0D29AFA257B029
/var/log/journal/ee49dfd4fa47433baee88884e2d7de7c/user-1000.journal	data	8173A0EB7D2F36391B4B80478A9E6BEF	ED1D9A823AED929011D203A83D905F5994376878	35D8EDB9AA9447D338B75DB1C102185B185105289A47B0E0E648BEF06D3267F1
/var/log/kern.log	ASCII text	9924872A6984F513D75D936C1BDDD6DF	B37C04FD8E07A72A99F277107130C5A26C807A65	08DD9A2FB60D63911081662B78A36D6C81BD75F5E034DA135A77FA55DF9FAE2A
/var/log/syslog	ASCII text, with very long lines (317)	BC624000B9890333841C9907269573FB	8F9E8F209B795626FDD10DC279335232FA167F56	5F576CA008FAF7D38A5CF490B979BDCFDD8C855B089FBE765254918B28CC430D
/var/log/wtmp	data	87FDE0927CF343DEFB230443175FDE2D	F851F7D6EC7AD1BD95CE6D2A3A6D2920EB858107	7C1F68317BDFB01D659F0086DDC59BBF125BEE66733941F8A6BC56D37016130A

Linux Analysis Report
jwwofba5.elf

Overview

General Information

Detection

Signatures

Classification

Malware Threat Intel
Provided by

Signatures

AV Detection

Bitcoin Miner

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Screenshots

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs

Linux Analysis Report jwwofba5.elf

Overview

General Information

Detection

Signatures

Classification

Malware Threat Intel Provided by

Signatures

AV Detection

Bitcoin Miner

Spreading

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Screenshots

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs

Linux Analysis Report
jwwofba5.elf

Malware Threat Intel
Provided by