Edit tour

Linux Analysis Report
yakuza.m68k.elf

Overview

General Information

Sample name:	yakuza.m68k.elf
Analysis ID:	1561399
MD5:	6f29cf16208a5a65d64fc40d9f161210
SHA1:	19642cf4cb5e7df090d2268d5e89f87c8df4baa9
SHA256:	5e6e4b917fdd5275e837fe3440fbb1b1bcb48dc4564f66dea69bdb43e4820f65
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	72
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Uses IRC for communication with a C&C

Uses known network protocols on non-standard ports

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "kill" or "pkill" command typically used to terminate processes

Reads CPU information from /sys indicative of miner or evasive malware

Sample and/or dropped files contains symbols with suspicious names

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample contains strings indicative of password brute-forcing capabilities

Sample contains strings that are user agent strings indicative of HTTP manipulation

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1561399
Start date and time:	2024-11-23 11:02:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 50s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	yakuza.m68k.elf
Detection:	MAL
Classification:	mal72.troj.linELF@0/0@0/0

Warnings

Report size exceeded maximum capacity and may have missing behavior information.

Runtime Messages

Command:	/tmp/yakuza.m68k.elf
PID:	6261
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	CAPSAICIN
Standard Error:

Process Tree

system is lnxubuntu20

yakuza.m68k.elf (PID: 6261, Parent: 6184, MD5: cd177594338c77b895ae27c33f8f86cc) Arguments: /tmp/yakuza.m68k.elf

yakuza.m68k.elf New Fork (PID: 6263, Parent: 6261)

yakuza.m68k.elf New Fork (PID: 6269, Parent: 6263)

yakuza.m68k.elf New Fork (PID: 6270, Parent: 6263)

yakuza.m68k.elf New Fork (PID: 6272, Parent: 6263)

sh (PID: 6272, Parent: 6263, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 902i13 || busybox pkill -9 902i13"

sh New Fork (PID: 6275, Parent: 6272)

pkill (PID: 6275, Parent: 6272, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 902i13

sh New Fork (PID: 6276, Parent: 6272)

busybox (PID: 6276, Parent: 6272, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 902i13

yakuza.m68k.elf New Fork (PID: 6279, Parent: 6263)

sh (PID: 6279, Parent: 6263, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 BzSxLxBxeY || busybox pkill -9 BzSxLxBxeY"

sh New Fork (PID: 6284, Parent: 6279)

pkill (PID: 6284, Parent: 6279, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 BzSxLxBxeY

sh New Fork (PID: 6285, Parent: 6279)

busybox (PID: 6285, Parent: 6279, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 BzSxLxBxeY

yakuza.m68k.elf New Fork (PID: 6287, Parent: 6263)

sh (PID: 6287, Parent: 6263, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 HOHO-LUGO7 || busybox pkill -9 HOHO-LUGO7"

sh New Fork (PID: 6289, Parent: 6287)

pkill (PID: 6289, Parent: 6287, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 HOHO-LUGO7

sh New Fork (PID: 6292, Parent: 6287)

busybox (PID: 6292, Parent: 6287, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 HOHO-LUGO7

yakuza.m68k.elf New Fork (PID: 6293, Parent: 6263)

sh (PID: 6293, Parent: 6263, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 HOHO-U79OL || busybox pkill -9 HOHO-U79OL"

sh New Fork (PID: 6295, Parent: 6293)

pkill (PID: 6295, Parent: 6293, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 HOHO-U79OL

sh New Fork (PID: 6296, Parent: 6293)

busybox (PID: 6296, Parent: 6293, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 HOHO-U79OL

yakuza.m68k.elf New Fork (PID: 6297, Parent: 6263)

sh (PID: 6297, Parent: 6263, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 JuYfouyf87 || busybox pkill -9 JuYfouyf87"

sh New Fork (PID: 6299, Parent: 6297)

pkill (PID: 6299, Parent: 6297, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 JuYfouyf87

sh New Fork (PID: 6300, Parent: 6297)

busybox (PID: 6300, Parent: 6297, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 JuYfouyf87

yakuza.m68k.elf New Fork (PID: 6303, Parent: 6263)

sh (PID: 6303, Parent: 6263, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 NiGGeR69xd || busybox pkill -9 NiGGeR69xd"

sh New Fork (PID: 6305, Parent: 6303)

pkill (PID: 6305, Parent: 6303, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 NiGGeR69xd

sh New Fork (PID: 6306, Parent: 6303)

busybox (PID: 6306, Parent: 6303, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 NiGGeR69xd

yakuza.m68k.elf New Fork (PID: 6307, Parent: 6263)

sh (PID: 6307, Parent: 6263, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 SO190Ij1X || busybox pkill -9 SO190Ij1X"

sh New Fork (PID: 6309, Parent: 6307)

pkill (PID: 6309, Parent: 6307, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 SO190Ij1X

sh New Fork (PID: 6310, Parent: 6307)

busybox (PID: 6310, Parent: 6307, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 SO190Ij1X

yakuza.m68k.elf New Fork (PID: 6313, Parent: 6263)

sh (PID: 6313, Parent: 6263, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 LOLKIKEEEDDE || busybox pkill -9 LOLKIKEEEDDE"

sh New Fork (PID: 6319, Parent: 6313)

pkill (PID: 6319, Parent: 6313, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 LOLKIKEEEDDE

sh New Fork (PID: 6320, Parent: 6313)

busybox (PID: 6320, Parent: 6313, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 LOLKIKEEEDDE

yakuza.m68k.elf New Fork (PID: 6343, Parent: 6263)

sh (PID: 6343, Parent: 6263, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 ekjheory98e || busybox pkill -9 ekjheory98e"

sh New Fork (PID: 6348, Parent: 6343)

pkill (PID: 6348, Parent: 6343, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 ekjheory98e

sh New Fork (PID: 6349, Parent: 6343)

busybox (PID: 6349, Parent: 6343, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 ekjheory98e

yakuza.m68k.elf New Fork (PID: 6352, Parent: 6263)

sh (PID: 6352, Parent: 6263, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 scansh4 || busybox pkill -9 scansh4"

sh New Fork (PID: 6354, Parent: 6352)

pkill (PID: 6354, Parent: 6352, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 scansh4

sh New Fork (PID: 6355, Parent: 6352)

busybox (PID: 6355, Parent: 6352, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 scansh4

yakuza.m68k.elf New Fork (PID: 6356, Parent: 6263)

sh (PID: 6356, Parent: 6263, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 MDMA || busybox pkill -9 MDMA"

sh New Fork (PID: 6362, Parent: 6356)

pkill (PID: 6362, Parent: 6356, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 MDMA

sh New Fork (PID: 6363, Parent: 6356)

busybox (PID: 6363, Parent: 6356, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 MDMA

yakuza.m68k.elf New Fork (PID: 6366, Parent: 6263)

sh (PID: 6366, Parent: 6263, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 fdevalvex || busybox pkill -9 fdevalvex"

sh New Fork (PID: 6368, Parent: 6366)

pkill (PID: 6368, Parent: 6366, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 fdevalvex

sh New Fork (PID: 6369, Parent: 6366)

busybox (PID: 6369, Parent: 6366, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 fdevalvex

yakuza.m68k.elf New Fork (PID: 6370, Parent: 6263)

sh (PID: 6370, Parent: 6263, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 scanspc || busybox pkill -9 scanspc"

sh New Fork (PID: 6375, Parent: 6370)

pkill (PID: 6375, Parent: 6370, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 scanspc

sh New Fork (PID: 6376, Parent: 6370)

busybox (PID: 6376, Parent: 6370, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 scanspc

yakuza.m68k.elf New Fork (PID: 6379, Parent: 6263)

sh (PID: 6379, Parent: 6263, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 MELTEDNINJAREALZ || busybox pkill -9 MELTEDNINJAREALZ"

sh New Fork (PID: 6381, Parent: 6379)

pkill (PID: 6381, Parent: 6379, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 MELTEDNINJAREALZ

sh New Fork (PID: 6382, Parent: 6379)

busybox (PID: 6382, Parent: 6379, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 MELTEDNINJAREALZ

yakuza.m68k.elf New Fork (PID: 6383, Parent: 6263)

sh (PID: 6383, Parent: 6263, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 flexsonskids || busybox pkill -9 flexsonskids"

sh New Fork (PID: 6385, Parent: 6383)

pkill (PID: 6385, Parent: 6383, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 flexsonskids

sh New Fork (PID: 6387, Parent: 6383)

busybox (PID: 6387, Parent: 6383, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 flexsonskids

yakuza.m68k.elf New Fork (PID: 6388, Parent: 6263)

sh (PID: 6388, Parent: 6263, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 scanx86 || busybox pkill -9 scanx86"

sh New Fork (PID: 6394, Parent: 6388)

pkill (PID: 6394, Parent: 6388, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 scanx86

sh New Fork (PID: 6397, Parent: 6388)

busybox (PID: 6397, Parent: 6388, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 scanx86

yakuza.m68k.elf New Fork (PID: 6398, Parent: 6263)

sh (PID: 6398, Parent: 6263, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 MISAKI-U79OL || busybox pkill -9 MISAKI-U79OL"

sh New Fork (PID: 6400, Parent: 6398)

pkill (PID: 6400, Parent: 6398, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 MISAKI-U79OL

sh New Fork (PID: 6401, Parent: 6398)

busybox (PID: 6401, Parent: 6398, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 MISAKI-U79OL

yakuza.m68k.elf New Fork (PID: 6402, Parent: 6263)

sh (PID: 6402, Parent: 6263, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 foAxi102kxe || busybox pkill -9 foAxi102kxe"

sh New Fork (PID: 6404, Parent: 6402)

pkill (PID: 6404, Parent: 6402, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 foAxi102kxe

sh New Fork (PID: 6407, Parent: 6402)

busybox (PID: 6407, Parent: 6402, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 foAxi102kxe

yakuza.m68k.elf New Fork (PID: 6408, Parent: 6263)

sh (PID: 6408, Parent: 6263, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 swodjwodjwoj || busybox pkill -9 swodjwodjwoj"

sh New Fork (PID: 6410, Parent: 6408)

pkill (PID: 6410, Parent: 6408, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 swodjwodjwoj

sh New Fork (PID: 6411, Parent: 6408)

busybox (PID: 6411, Parent: 6408, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 swodjwodjwoj

yakuza.m68k.elf New Fork (PID: 6412, Parent: 6263)

sh (PID: 6412, Parent: 6263, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 MmKiy7f87l || busybox pkill -9 MmKiy7f87l"

sh New Fork (PID: 6417, Parent: 6412)

pkill (PID: 6417, Parent: 6412, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 MmKiy7f87l

sh New Fork (PID: 6418, Parent: 6412)

busybox (PID: 6418, Parent: 6412, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 MmKiy7f87l

yakuza.m68k.elf New Fork (PID: 6421, Parent: 6263)

sh (PID: 6421, Parent: 6263, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 freecookiex86 || busybox pkill -9 freecookiex86"

sh New Fork (PID: 6423, Parent: 6421)

pkill (PID: 6423, Parent: 6421, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 freecookiex86

sh New Fork (PID: 6424, Parent: 6421)

busybox (PID: 6424, Parent: 6421, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 freecookiex86

yakuza.m68k.elf New Fork (PID: 6427, Parent: 6263)

sh (PID: 6427, Parent: 6263, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 sysgpu || busybox pkill -9 sysgpu"

sh New Fork (PID: 6432, Parent: 6427)

pkill (PID: 6432, Parent: 6427, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 sysgpu

sh New Fork (PID: 6433, Parent: 6427)

busybox (PID: 6433, Parent: 6427, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 sysgpu

yakuza.m68k.elf New Fork (PID: 6436, Parent: 6263)

sh (PID: 6436, Parent: 6263, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 NiGGeR69xd || busybox pkill -9 NiGGeR69xd"

sh New Fork (PID: 6438, Parent: 6436)

pkill (PID: 6438, Parent: 6436, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 NiGGeR69xd

sh New Fork (PID: 6439, Parent: 6436)

busybox (PID: 6439, Parent: 6436, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 NiGGeR69xd

yakuza.m68k.elf New Fork (PID: 6440, Parent: 6263)

sh (PID: 6440, Parent: 6263, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 frgege || busybox pkill -9 frgege"

sh New Fork (PID: 6442, Parent: 6440)

pkill (PID: 6442, Parent: 6440, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 frgege

sh New Fork (PID: 6443, Parent: 6440)

busybox (PID: 6443, Parent: 6440, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 frgege

yakuza.m68k.elf New Fork (PID: 6444, Parent: 6263)

sh (PID: 6444, Parent: 6263, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 sysupdater || busybox pkill -9 sysupdater"

sh New Fork (PID: 6450, Parent: 6444)

pkill (PID: 6450, Parent: 6444, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 sysupdater

sh New Fork (PID: 6453, Parent: 6444)

busybox (PID: 6453, Parent: 6444, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 sysupdater

yakuza.m68k.elf New Fork (PID: 6454, Parent: 6263)

sh (PID: 6454, Parent: 6263, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 0DnAzepd || busybox pkill -9 0DnAzepd"

sh New Fork (PID: 6456, Parent: 6454)

pkill (PID: 6456, Parent: 6454, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 0DnAzepd

sh New Fork (PID: 6457, Parent: 6454)

busybox (PID: 6457, Parent: 6454, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 0DnAzepd

yakuza.m68k.elf New Fork (PID: 6458, Parent: 6263)

sh (PID: 6458, Parent: 6263, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 NiGGeRD0nks69 || busybox pkill -9 NiGGeRD0nks69"

sh New Fork (PID: 6460, Parent: 6458)

pkill (PID: 6460, Parent: 6458, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 NiGGeRD0nks69

sh New Fork (PID: 6463, Parent: 6458)

busybox (PID: 6463, Parent: 6458, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 NiGGeRD0nks69

yakuza.m68k.elf New Fork (PID: 6464, Parent: 6263)

sh (PID: 6464, Parent: 6263, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 frgreu || busybox pkill -9 frgreu"

sh New Fork (PID: 6466, Parent: 6464)

pkill (PID: 6466, Parent: 6464, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 frgreu

sh New Fork (PID: 6467, Parent: 6464)

busybox (PID: 6467, Parent: 6464, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 frgreu

yakuza.m68k.elf New Fork (PID: 6469, Parent: 6263)

sh (PID: 6469, Parent: 6263, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 telnetd || busybox pkill -9 telnetd"

sh New Fork (PID: 6475, Parent: 6469)

pkill (PID: 6475, Parent: 6469, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 telnetd

sh New Fork (PID: 6478, Parent: 6469)

busybox (PID: 6478, Parent: 6469, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 telnetd

yakuza.m68k.elf New Fork (PID: 6479, Parent: 6263)

sh (PID: 6479, Parent: 6263, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 0x766f6964 || busybox pkill -9 0x766f6964"

sh New Fork (PID: 6484, Parent: 6479)

pkill (PID: 6484, Parent: 6479, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 0x766f6964

sh New Fork (PID: 6485, Parent: 6479)

busybox (PID: 6485, Parent: 6479, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 0x766f6964

yakuza.m68k.elf New Fork (PID: 6486, Parent: 6263)

sh (PID: 6486, Parent: 6263, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 NiGGeRd0nks1337 || busybox pkill -9 NiGGeRd0nks1337"

sh New Fork (PID: 6488, Parent: 6486)

pkill (PID: 6488, Parent: 6486, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 NiGGeRd0nks1337

sh New Fork (PID: 6489, Parent: 6486)

busybox (PID: 6489, Parent: 6486, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 NiGGeRd0nks1337

yakuza.m68k.elf New Fork (PID: 6492, Parent: 6263)

sh (PID: 6492, Parent: 6263, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 gaft || busybox pkill -9 gaft"

sh New Fork (PID: 6497, Parent: 6492)

pkill (PID: 6497, Parent: 6492, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 gaft

sh New Fork (PID: 6498, Parent: 6492)

busybox (PID: 6498, Parent: 6492, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 gaft

yakuza.m68k.elf New Fork (PID: 6499, Parent: 6263)

sh (PID: 6499, Parent: 6263, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 urasgbsigboa || busybox pkill -9 urasgbsigboa"

sh New Fork (PID: 6503, Parent: 6499)

pkill (PID: 6503, Parent: 6499, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 urasgbsigboa

sh New Fork (PID: 6505, Parent: 6499)

busybox (PID: 6505, Parent: 6499, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 urasgbsigboa

yakuza.m68k.elf New Fork (PID: 6508, Parent: 6263)

sh (PID: 6508, Parent: 6263, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 120i3UI49 || busybox pkill -9 120i3UI49"

sh New Fork (PID: 6512, Parent: 6508)

pkill (PID: 6512, Parent: 6508, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 120i3UI49

sh New Fork (PID: 6514, Parent: 6508)

busybox (PID: 6514, Parent: 6508, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 120i3UI49

yakuza.m68k.elf New Fork (PID: 6515, Parent: 6263)

sh (PID: 6515, Parent: 6263, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 OaF3 || busybox pkill -9 OaF3"

sh New Fork (PID: 6520, Parent: 6515)

pkill (PID: 6520, Parent: 6515, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 OaF3

sh New Fork (PID: 6521, Parent: 6515)

busybox (PID: 6521, Parent: 6515, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 OaF3

yakuza.m68k.elf New Fork (PID: 6524, Parent: 6263)

sh (PID: 6524, Parent: 6263, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 geae || busybox pkill -9 geae"

sh New Fork (PID: 6530, Parent: 6524)

pkill (PID: 6530, Parent: 6524, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 geae

sh New Fork (PID: 6531, Parent: 6524)

busybox (PID: 6531, Parent: 6524, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 geae

yakuza.m68k.elf New Fork (PID: 6532, Parent: 6263)

sh (PID: 6532, Parent: 6263, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 vaiolmao || busybox pkill -9 vaiolmao"

sh New Fork (PID: 6537, Parent: 6532)

pkill (PID: 6537, Parent: 6532, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 vaiolmao

sh New Fork (PID: 6538, Parent: 6532)

busybox (PID: 6538, Parent: 6532, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 vaiolmao

yakuza.m68k.elf New Fork (PID: 6539, Parent: 6263)

sh (PID: 6539, Parent: 6263, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 123123a || busybox pkill -9 123123a"

sh New Fork (PID: 6544, Parent: 6539)

pkill (PID: 6544, Parent: 6539, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 123123a

sh New Fork (PID: 6547, Parent: 6539)

busybox (PID: 6547, Parent: 6539, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 123123a

yakuza.m68k.elf New Fork (PID: 6548, Parent: 6263)

sh (PID: 6548, Parent: 6263, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 Ofurain0n4H34D || busybox pkill -9 Ofurain0n4H34D"

sh New Fork (PID: 6553, Parent: 6548)

pkill (PID: 6553, Parent: 6548, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 Ofurain0n4H34D

sh New Fork (PID: 6554, Parent: 6548)

busybox (PID: 6554, Parent: 6548, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 Ofurain0n4H34D

yakuza.m68k.elf New Fork (PID: 6555, Parent: 6263)

sh (PID: 6555, Parent: 6263, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 ggTrex || busybox pkill -9 ggTrex"

sh New Fork (PID: 6560, Parent: 6555)

pkill (PID: 6560, Parent: 6555, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 ggTrex

sh New Fork (PID: 6563, Parent: 6555)

busybox (PID: 6563, Parent: 6555, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 ggTrex

yakuza.m68k.elf New Fork (PID: 6564, Parent: 6263)

sh (PID: 6564, Parent: 6263, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 wasads || busybox pkill -9 wasads"

sh New Fork (PID: 6566, Parent: 6564)

pkill (PID: 6566, Parent: 6564, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 wasads

sh New Fork (PID: 6568, Parent: 6564)

busybox (PID: 6568, Parent: 6564, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 wasads

yakuza.m68k.elf New Fork (PID: 6570, Parent: 6263)

sh (PID: 6570, Parent: 6263, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 1293194hjXD || busybox pkill -9 1293194hjXD"

sh New Fork (PID: 6576, Parent: 6570)

pkill (PID: 6576, Parent: 6570, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 1293194hjXD

sh New Fork (PID: 6577, Parent: 6570)

busybox (PID: 6577, Parent: 6570, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 1293194hjXD

yakuza.m68k.elf New Fork (PID: 6580, Parent: 6263)

sh (PID: 6580, Parent: 6263, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 OthLaLosn || busybox pkill -9 OthLaLosn"

sh New Fork (PID: 6585, Parent: 6580)

pkill (PID: 6585, Parent: 6580, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 OthLaLosn

sh New Fork (PID: 6586, Parent: 6580)

busybox (PID: 6586, Parent: 6580, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 OthLaLosn

yakuza.m68k.elf New Fork (PID: 6587, Parent: 6263)

sh (PID: 6587, Parent: 6263, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 ggt || busybox pkill -9 ggt"

sh New Fork (PID: 6592, Parent: 6587)

pkill (PID: 6592, Parent: 6587, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 ggt

sh New Fork (PID: 6593, Parent: 6587)

busybox (PID: 6593, Parent: 6587, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 ggt

yakuza.m68k.elf New Fork (PID: 6596, Parent: 6263)

sh (PID: 6596, Parent: 6263, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 wget-log || busybox pkill -9 wget-log"

sh New Fork (PID: 6601, Parent: 6596)

pkill (PID: 6601, Parent: 6596, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 wget-log

sh New Fork (PID: 6602, Parent: 6596)

busybox (PID: 6602, Parent: 6596, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 wget-log

yakuza.m68k.elf New Fork (PID: 6603, Parent: 6263)

sh (PID: 6603, Parent: 6263, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 1337SoraLOADER || busybox pkill -9 1337SoraLOADER"

sh New Fork (PID: 6608, Parent: 6603)

pkill (PID: 6608, Parent: 6603, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 1337SoraLOADER

sh New Fork (PID: 6609, Parent: 6603)

busybox (PID: 6609, Parent: 6603, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 1337SoraLOADER

yakuza.m68k.elf New Fork (PID: 6610, Parent: 6263)

sh (PID: 6610, Parent: 6263, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 SAIAKINA || busybox pkill -9 SAIAKINA"

sh New Fork (PID: 6615, Parent: 6610)

pkill (PID: 6615, Parent: 6610, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 SAIAKINA

sh New Fork (PID: 6618, Parent: 6610)

busybox (PID: 6618, Parent: 6610, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 SAIAKINA

yakuza.m68k.elf New Fork (PID: 6619, Parent: 6263)

sh (PID: 6619, Parent: 6263, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 ggtq || busybox pkill -9 ggtq"

sh New Fork (PID: 6621, Parent: 6619)

pkill (PID: 6621, Parent: 6619, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 ggtq

sh New Fork (PID: 6624, Parent: 6619)

busybox (PID: 6624, Parent: 6619, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 ggtq

yakuza.m68k.elf New Fork (PID: 6625, Parent: 6263)

sh (PID: 6625, Parent: 6263, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 1378bfp919GRB1Q2 || busybox pkill -9 1378bfp919GRB1Q2"

sh New Fork (PID: 6631, Parent: 6625)

pkill (PID: 6631, Parent: 6625, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 1378bfp919GRB1Q2

sh New Fork (PID: 6632, Parent: 6625)

busybox (PID: 6632, Parent: 6625, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 1378bfp919GRB1Q2

yakuza.m68k.elf New Fork (PID: 6635, Parent: 6263)

sh (PID: 6635, Parent: 6263, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 SAIAKUSO || busybox pkill -9 SAIAKUSO"

sh New Fork (PID: 6640, Parent: 6635)

pkill (PID: 6640, Parent: 6635, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 SAIAKUSO

sh New Fork (PID: 6641, Parent: 6635)

busybox (PID: 6641, Parent: 6635, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 SAIAKUSO

yakuza.m68k.elf New Fork (PID: 6642, Parent: 6263)

sh (PID: 6642, Parent: 6263, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 ggtr || busybox pkill -9 ggtr"

sh New Fork (PID: 6647, Parent: 6642)

pkill (PID: 6647, Parent: 6642, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 ggtr

sh New Fork (PID: 6648, Parent: 6642)

busybox (PID: 6648, Parent: 6642, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 ggtr

yakuza.m68k.elf New Fork (PID: 6651, Parent: 6263)

sh (PID: 6651, Parent: 6263, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 14Fa || busybox pkill -9 14Fa"

sh New Fork (PID: 6653, Parent: 6651)

pkill (PID: 6653, Parent: 6651, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 14Fa

sh New Fork (PID: 6654, Parent: 6651)

busybox (PID: 6654, Parent: 6651, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 14Fa

yakuza.m68k.elf New Fork (PID: 6655, Parent: 6263)

sh (PID: 6655, Parent: 6263, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 SEXSLAVE1337 || busybox pkill -9 SEXSLAVE1337"

sh New Fork (PID: 6660, Parent: 6655)

pkill (PID: 6660, Parent: 6655, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 SEXSLAVE1337

sh New Fork (PID: 6661, Parent: 6655)

busybox (PID: 6661, Parent: 6655, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 SEXSLAVE1337

yakuza.m68k.elf New Fork (PID: 6664, Parent: 6263)

sh (PID: 6664, Parent: 6263, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 ggtt || busybox pkill -9 ggtt"

sh New Fork (PID: 6666, Parent: 6664)

pkill (PID: 6666, Parent: 6664, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 ggtt

sh New Fork (PID: 6667, Parent: 6664)

busybox (PID: 6667, Parent: 6664, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 ggtt

yakuza.m68k.elf New Fork (PID: 6668, Parent: 6263)

sh (PID: 6668, Parent: 6263, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 1902a3u912u3u4 || busybox pkill -9 1902a3u912u3u4"

sh New Fork (PID: 6673, Parent: 6668)

pkill (PID: 6673, Parent: 6668, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 1902a3u912u3u4

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
yakuza.m68k.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
yakuza.m68k.elf	Linux_Trojan_Tsunami_8a11f9be	unknown	unknown	0x19569:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20 0x19bc2:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20

Memory Dumps

Source	Rule	Description	Author	Strings
6261.1.00007f14ac001000.00007f14ac01e000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6261.1.00007f14ac001000.00007f14ac01e000.r-x.sdmp	Linux_Trojan_Tsunami_8a11f9be	unknown	unknown	0x19569:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20 0x19bc2:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20
Process Memory Space: yakuza.m68k.elf PID: 6261	Linux_Trojan_Tsunami_8a11f9be	unknown	unknown	0x44bc:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20 0x45f1:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20 0x4bc9:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: yakuza.m68k.elf

ReversingLabs: Detection: 57%

Source: /usr/bin/pkill (PID: 6275)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6284)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6289)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6295)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6299)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6305)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6309)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6319)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6348)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6354)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6362)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6368)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6375)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6381)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6385)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6400)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6404)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6410)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6417)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6423)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6432)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6438)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6442)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6450)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6456)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6460)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6466)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6475)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6484)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6488)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6497)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6503)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6512)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6520)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6530)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6537)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6544)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6553)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6560)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6566)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6576)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6585)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6592)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6601)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6608)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6615)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6621)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6631)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6640)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6647)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6653)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6660)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6666)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6673)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Networking

Uses IRC for communication with a C&C

Source: unknown

IRC traffic detected: 192.168.2.23:38752 -> 95.234.158.87:6780 NICK [OSX|M68K]PaIepvQ USER PaIepvQ localhost localhost :PaIepvQ

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: IRC traffic on port 38752 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 38754 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 38756 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 38758 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 38760 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 38762 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 38764 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 38766 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 38768 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 38770 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 38772 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 38774 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 38776 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 38778 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 38780 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 38782 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 38784 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 38784 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 38784 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 38786 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 38788 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 38790 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 38792 -> 6780

Source: global traffic

TCP traffic: 192.168.2.23:38752 -> 95.234.158.87:6780

Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80
Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443

Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87

Source: yakuza.m68k.elf	String found in binary or memory: http://linux-it.abuser.eu/yak.sh;
Source: yakuza.m68k.elf	String found in binary or memory: https://youtu.be/dQw4w9WgXcQ
Source: yakuza.m68k.elf	String found in binary or memory: https://youtu.be/dQw4w9WgXcQNever

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: yakuza.m68k.elf, type: SAMPLE	Matched rule: Linux_Trojan_Tsunami_8a11f9be Author: unknown
Source: 6261.1.00007f14ac001000.00007f14ac01e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_8a11f9be Author: unknown
Source: Process Memory Space: yakuza.m68k.elf PID: 6261, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_8a11f9be Author: unknown

Source: yakuza.m68k.elf	ELF static info symbol of initial sample: passwords
Source: yakuza.m68k.elf	ELF static info symbol of initial sample: usernames

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: pkill -9 %s \|\| busybox pkill -9 %s
Source: Initial sample	String containing 'busybox' found: pkill -9 %s \|\| busybox pkill -9 %shistory -c;history -wcd /root;rm -f .bash_historycd /var/tmp; rm -f *NOTICE %s :MOVE <server>

Source: Initial sample	String containing potential weak password found: guest
Source: Initial sample	String containing potential weak password found: default
Source: Initial sample	String containing potential weak password found: admin
Source: Initial sample	String containing potential weak password found: supervisor
Source: Initial sample	String containing potential weak password found: service
Source: Initial sample	String containing potential weak password found: administrator
Source: Initial sample	String containing potential weak password found: support
Source: Initial sample	String containing potential weak password found: 123456
Source: Initial sample	String containing potential weak password found: password
Source: Initial sample	String containing potential weak password found: 12345

Source: yakuza.m68k.elf, type: SAMPLE	Matched rule: Linux_Trojan_Tsunami_8a11f9be reference_sample = 1f773d0e00d40eecde9e3ab80438698923a2620036c2fc33315ef95229e98571, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = 91e2572a3bb8583e20042578e95e1746501c6a71ef7635af2c982a05b18d7c6d, id = 8a11f9be-dc85-4695-9f38-80ca0304780e, last_modified = 2021-09-16
Source: 6261.1.00007f14ac001000.00007f14ac01e000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_8a11f9be reference_sample = 1f773d0e00d40eecde9e3ab80438698923a2620036c2fc33315ef95229e98571, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = 91e2572a3bb8583e20042578e95e1746501c6a71ef7635af2c982a05b18d7c6d, id = 8a11f9be-dc85-4695-9f38-80ca0304780e, last_modified = 2021-09-16
Source: Process Memory Space: yakuza.m68k.elf PID: 6261, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_8a11f9be reference_sample = 1f773d0e00d40eecde9e3ab80438698923a2620036c2fc33315ef95229e98571, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = 91e2572a3bb8583e20042578e95e1746501c6a71ef7635af2c982a05b18d7c6d, id = 8a11f9be-dc85-4695-9f38-80ca0304780e, last_modified = 2021-09-16

Source: classification engine

Classification label: mal72.troj.linELF@0/0@0/0

Source: yakuza.m68k.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/m68k/crt1.S
Source: yakuza.m68k.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/m68k/crti.S
Source: yakuza.m68k.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/m68k/crtn.S
Source: yakuza.m68k.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/m68k/vfork.S

Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/1582/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/1582/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/3088/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/3088/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/230/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/230/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/110/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/110/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/231/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/231/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/111/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/111/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/232/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/232/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/1579/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/1579/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/112/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/112/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/233/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/233/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/1699/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/1699/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/113/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/113/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/234/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/234/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/1335/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/1335/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/1698/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/1698/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/114/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/114/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/235/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/235/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/1334/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/1334/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/1576/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/1576/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/2302/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/2302/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/115/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/115/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/236/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/236/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/116/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/116/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/237/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/237/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/117/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/117/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/118/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/118/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/910/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/910/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/119/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/119/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/912/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/912/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/10/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/10/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/2307/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/2307/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/11/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/11/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/918/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/918/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/12/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/12/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/13/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/13/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/14/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/14/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/15/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/15/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/6245/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/6245/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/16/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/16/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/17/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/17/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/18/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/18/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/6246/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/6246/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/1594/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/1594/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/120/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/120/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/121/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/121/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/1349/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/1349/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/1/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/1/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/122/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/122/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/243/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/243/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/123/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/123/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/2/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/2/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/124/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/124/cmdline	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/3/status	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	File opened: /proc/3/cmdline	Jump to behavior

Source: /tmp/yakuza.m68k.elf (PID: 6272)	Shell command executed: sh -c "pkill -9 902i13 \|\| busybox pkill -9 902i13"	Jump to behavior
Source: /tmp/yakuza.m68k.elf (PID: 6279)	Shell command executed: sh -c "pkill -9 BzSxLxBxeY \|\| busybox pkill -9 BzSxLxBxeY"	Jump to behavior
Source: /tmp/yakuza.m68k.elf (PID: 6287)	Shell command executed: sh -c "pkill -9 HOHO-LUGO7 \|\| busybox pkill -9 HOHO-LUGO7"	Jump to behavior
Source: /tmp/yakuza.m68k.elf (PID: 6293)	Shell command executed: sh -c "pkill -9 HOHO-U79OL \|\| busybox pkill -9 HOHO-U79OL"	Jump to behavior
Source: /tmp/yakuza.m68k.elf (PID: 6297)	Shell command executed: sh -c "pkill -9 JuYfouyf87 \|\| busybox pkill -9 JuYfouyf87"	Jump to behavior
Source: /tmp/yakuza.m68k.elf (PID: 6303)	Shell command executed: sh -c "pkill -9 NiGGeR69xd \|\| busybox pkill -9 NiGGeR69xd"	Jump to behavior
Source: /tmp/yakuza.m68k.elf (PID: 6307)	Shell command executed: sh -c "pkill -9 SO190Ij1X \|\| busybox pkill -9 SO190Ij1X"	Jump to behavior
Source: /tmp/yakuza.m68k.elf (PID: 6313)	Shell command executed: sh -c "pkill -9 LOLKIKEEEDDE \|\| busybox pkill -9 LOLKIKEEEDDE"	Jump to behavior
Source: /tmp/yakuza.m68k.elf (PID: 6343)	Shell command executed: sh -c "pkill -9 ekjheory98e \|\| busybox pkill -9 ekjheory98e"	Jump to behavior
Source: /tmp/yakuza.m68k.elf (PID: 6352)	Shell command executed: sh -c "pkill -9 scansh4 \|\| busybox pkill -9 scansh4"	Jump to behavior
Source: /tmp/yakuza.m68k.elf (PID: 6356)	Shell command executed: sh -c "pkill -9 MDMA \|\| busybox pkill -9 MDMA"	Jump to behavior
Source: /tmp/yakuza.m68k.elf (PID: 6366)	Shell command executed: sh -c "pkill -9 fdevalvex \|\| busybox pkill -9 fdevalvex"	Jump to behavior
Source: /tmp/yakuza.m68k.elf (PID: 6370)	Shell command executed: sh -c "pkill -9 scanspc \|\| busybox pkill -9 scanspc"	Jump to behavior
Source: /tmp/yakuza.m68k.elf (PID: 6379)	Shell command executed: sh -c "pkill -9 MELTEDNINJAREALZ \|\| busybox pkill -9 MELTEDNINJAREALZ"	Jump to behavior
Source: /tmp/yakuza.m68k.elf (PID: 6383)	Shell command executed: sh -c "pkill -9 flexsonskids \|\| busybox pkill -9 flexsonskids"	Jump to behavior
Source: /tmp/yakuza.m68k.elf (PID: 6388)	Shell command executed: sh -c "pkill -9 scanx86 \|\| busybox pkill -9 scanx86"	Jump to behavior
Source: /tmp/yakuza.m68k.elf (PID: 6398)	Shell command executed: sh -c "pkill -9 MISAKI-U79OL \|\| busybox pkill -9 MISAKI-U79OL"
Source: /tmp/yakuza.m68k.elf (PID: 6402)	Shell command executed: sh -c "pkill -9 foAxi102kxe \|\| busybox pkill -9 foAxi102kxe"
Source: /tmp/yakuza.m68k.elf (PID: 6408)	Shell command executed: sh -c "pkill -9 swodjwodjwoj \|\| busybox pkill -9 swodjwodjwoj"
Source: /tmp/yakuza.m68k.elf (PID: 6412)	Shell command executed: sh -c "pkill -9 MmKiy7f87l \|\| busybox pkill -9 MmKiy7f87l"
Source: /tmp/yakuza.m68k.elf (PID: 6421)	Shell command executed: sh -c "pkill -9 freecookiex86 \|\| busybox pkill -9 freecookiex86"
Source: /tmp/yakuza.m68k.elf (PID: 6427)	Shell command executed: sh -c "pkill -9 sysgpu \|\| busybox pkill -9 sysgpu"
Source: /tmp/yakuza.m68k.elf (PID: 6436)	Shell command executed: sh -c "pkill -9 NiGGeR69xd \|\| busybox pkill -9 NiGGeR69xd"
Source: /tmp/yakuza.m68k.elf (PID: 6440)	Shell command executed: sh -c "pkill -9 frgege \|\| busybox pkill -9 frgege"
Source: /tmp/yakuza.m68k.elf (PID: 6444)	Shell command executed: sh -c "pkill -9 sysupdater \|\| busybox pkill -9 sysupdater"
Source: /tmp/yakuza.m68k.elf (PID: 6454)	Shell command executed: sh -c "pkill -9 0DnAzepd \|\| busybox pkill -9 0DnAzepd"
Source: /tmp/yakuza.m68k.elf (PID: 6458)	Shell command executed: sh -c "pkill -9 NiGGeRD0nks69 \|\| busybox pkill -9 NiGGeRD0nks69"
Source: /tmp/yakuza.m68k.elf (PID: 6464)	Shell command executed: sh -c "pkill -9 frgreu \|\| busybox pkill -9 frgreu"
Source: /tmp/yakuza.m68k.elf (PID: 6469)	Shell command executed: sh -c "pkill -9 telnetd \|\| busybox pkill -9 telnetd"
Source: /tmp/yakuza.m68k.elf (PID: 6479)	Shell command executed: sh -c "pkill -9 0x766f6964 \|\| busybox pkill -9 0x766f6964"
Source: /tmp/yakuza.m68k.elf (PID: 6486)	Shell command executed: sh -c "pkill -9 NiGGeRd0nks1337 \|\| busybox pkill -9 NiGGeRd0nks1337"
Source: /tmp/yakuza.m68k.elf (PID: 6492)	Shell command executed: sh -c "pkill -9 gaft \|\| busybox pkill -9 gaft"
Source: /tmp/yakuza.m68k.elf (PID: 6499)	Shell command executed: sh -c "pkill -9 urasgbsigboa \|\| busybox pkill -9 urasgbsigboa"
Source: /tmp/yakuza.m68k.elf (PID: 6508)	Shell command executed: sh -c "pkill -9 120i3UI49 \|\| busybox pkill -9 120i3UI49"
Source: /tmp/yakuza.m68k.elf (PID: 6515)	Shell command executed: sh -c "pkill -9 OaF3 \|\| busybox pkill -9 OaF3"
Source: /tmp/yakuza.m68k.elf (PID: 6524)	Shell command executed: sh -c "pkill -9 geae \|\| busybox pkill -9 geae"
Source: /tmp/yakuza.m68k.elf (PID: 6532)	Shell command executed: sh -c "pkill -9 vaiolmao \|\| busybox pkill -9 vaiolmao"
Source: /tmp/yakuza.m68k.elf (PID: 6539)	Shell command executed: sh -c "pkill -9 123123a \|\| busybox pkill -9 123123a"
Source: /tmp/yakuza.m68k.elf (PID: 6548)	Shell command executed: sh -c "pkill -9 Ofurain0n4H34D \|\| busybox pkill -9 Ofurain0n4H34D"
Source: /tmp/yakuza.m68k.elf (PID: 6555)	Shell command executed: sh -c "pkill -9 ggTrex \|\| busybox pkill -9 ggTrex"
Source: /tmp/yakuza.m68k.elf (PID: 6564)	Shell command executed: sh -c "pkill -9 wasads \|\| busybox pkill -9 wasads"
Source: /tmp/yakuza.m68k.elf (PID: 6570)	Shell command executed: sh -c "pkill -9 1293194hjXD \|\| busybox pkill -9 1293194hjXD"
Source: /tmp/yakuza.m68k.elf (PID: 6580)	Shell command executed: sh -c "pkill -9 OthLaLosn \|\| busybox pkill -9 OthLaLosn"
Source: /tmp/yakuza.m68k.elf (PID: 6587)	Shell command executed: sh -c "pkill -9 ggt \|\| busybox pkill -9 ggt"
Source: /tmp/yakuza.m68k.elf (PID: 6596)	Shell command executed: sh -c "pkill -9 wget-log \|\| busybox pkill -9 wget-log"
Source: /tmp/yakuza.m68k.elf (PID: 6603)	Shell command executed: sh -c "pkill -9 1337SoraLOADER \|\| busybox pkill -9 1337SoraLOADER"
Source: /tmp/yakuza.m68k.elf (PID: 6610)	Shell command executed: sh -c "pkill -9 SAIAKINA \|\| busybox pkill -9 SAIAKINA"
Source: /tmp/yakuza.m68k.elf (PID: 6619)	Shell command executed: sh -c "pkill -9 ggtq \|\| busybox pkill -9 ggtq"
Source: /tmp/yakuza.m68k.elf (PID: 6625)	Shell command executed: sh -c "pkill -9 1378bfp919GRB1Q2 \|\| busybox pkill -9 1378bfp919GRB1Q2"
Source: /tmp/yakuza.m68k.elf (PID: 6635)	Shell command executed: sh -c "pkill -9 SAIAKUSO \|\| busybox pkill -9 SAIAKUSO"
Source: /tmp/yakuza.m68k.elf (PID: 6642)	Shell command executed: sh -c "pkill -9 ggtr \|\| busybox pkill -9 ggtr"
Source: /tmp/yakuza.m68k.elf (PID: 6651)	Shell command executed: sh -c "pkill -9 14Fa \|\| busybox pkill -9 14Fa"
Source: /tmp/yakuza.m68k.elf (PID: 6655)	Shell command executed: sh -c "pkill -9 SEXSLAVE1337 \|\| busybox pkill -9 SEXSLAVE1337"
Source: /tmp/yakuza.m68k.elf (PID: 6664)	Shell command executed: sh -c "pkill -9 ggtt \|\| busybox pkill -9 ggtt"
Source: /tmp/yakuza.m68k.elf (PID: 6668)	Shell command executed: sh -c "pkill -9 1902a3u912u3u4 \|\| busybox pkill -9 1902a3u912u3u4"

Source: /bin/sh (PID: 6275)	Pkill executable: /usr/bin/pkill -> pkill -9 902i13	Jump to behavior
Source: /bin/sh (PID: 6284)	Pkill executable: /usr/bin/pkill -> pkill -9 BzSxLxBxeY	Jump to behavior
Source: /bin/sh (PID: 6289)	Pkill executable: /usr/bin/pkill -> pkill -9 HOHO-LUGO7	Jump to behavior
Source: /bin/sh (PID: 6295)	Pkill executable: /usr/bin/pkill -> pkill -9 HOHO-U79OL	Jump to behavior
Source: /bin/sh (PID: 6299)	Pkill executable: /usr/bin/pkill -> pkill -9 JuYfouyf87	Jump to behavior
Source: /bin/sh (PID: 6305)	Pkill executable: /usr/bin/pkill -> pkill -9 NiGGeR69xd	Jump to behavior
Source: /bin/sh (PID: 6309)	Pkill executable: /usr/bin/pkill -> pkill -9 SO190Ij1X	Jump to behavior
Source: /bin/sh (PID: 6319)	Pkill executable: /usr/bin/pkill -> pkill -9 LOLKIKEEEDDE	Jump to behavior
Source: /bin/sh (PID: 6348)	Pkill executable: /usr/bin/pkill -> pkill -9 ekjheory98e	Jump to behavior
Source: /bin/sh (PID: 6354)	Pkill executable: /usr/bin/pkill -> pkill -9 scansh4	Jump to behavior
Source: /bin/sh (PID: 6362)	Pkill executable: /usr/bin/pkill -> pkill -9 MDMA	Jump to behavior
Source: /bin/sh (PID: 6368)	Pkill executable: /usr/bin/pkill -> pkill -9 fdevalvex	Jump to behavior
Source: /bin/sh (PID: 6375)	Pkill executable: /usr/bin/pkill -> pkill -9 scanspc	Jump to behavior
Source: /bin/sh (PID: 6381)	Pkill executable: /usr/bin/pkill -> pkill -9 MELTEDNINJAREALZ	Jump to behavior
Source: /bin/sh (PID: 6385)	Pkill executable: /usr/bin/pkill -> pkill -9 flexsonskids	Jump to behavior
Source: /bin/sh (PID: 6394)	Pkill executable: /usr/bin/pkill -> pkill -9 scanx86	Jump to behavior
Source: /bin/sh (PID: 6400)	Pkill executable: /usr/bin/pkill -> pkill -9 MISAKI-U79OL
Source: /bin/sh (PID: 6404)	Pkill executable: /usr/bin/pkill -> pkill -9 foAxi102kxe
Source: /bin/sh (PID: 6410)	Pkill executable: /usr/bin/pkill -> pkill -9 swodjwodjwoj
Source: /bin/sh (PID: 6417)	Pkill executable: /usr/bin/pkill -> pkill -9 MmKiy7f87l
Source: /bin/sh (PID: 6423)	Pkill executable: /usr/bin/pkill -> pkill -9 freecookiex86
Source: /bin/sh (PID: 6432)	Pkill executable: /usr/bin/pkill -> pkill -9 sysgpu
Source: /bin/sh (PID: 6438)	Pkill executable: /usr/bin/pkill -> pkill -9 NiGGeR69xd
Source: /bin/sh (PID: 6442)	Pkill executable: /usr/bin/pkill -> pkill -9 frgege
Source: /bin/sh (PID: 6450)	Pkill executable: /usr/bin/pkill -> pkill -9 sysupdater
Source: /bin/sh (PID: 6456)	Pkill executable: /usr/bin/pkill -> pkill -9 0DnAzepd
Source: /bin/sh (PID: 6460)	Pkill executable: /usr/bin/pkill -> pkill -9 NiGGeRD0nks69
Source: /bin/sh (PID: 6466)	Pkill executable: /usr/bin/pkill -> pkill -9 frgreu
Source: /bin/sh (PID: 6475)	Pkill executable: /usr/bin/pkill -> pkill -9 telnetd
Source: /bin/sh (PID: 6484)	Pkill executable: /usr/bin/pkill -> pkill -9 0x766f6964
Source: /bin/sh (PID: 6488)	Pkill executable: /usr/bin/pkill -> pkill -9 NiGGeRd0nks1337
Source: /bin/sh (PID: 6497)	Pkill executable: /usr/bin/pkill -> pkill -9 gaft
Source: /bin/sh (PID: 6503)	Pkill executable: /usr/bin/pkill -> pkill -9 urasgbsigboa
Source: /bin/sh (PID: 6512)	Pkill executable: /usr/bin/pkill -> pkill -9 120i3UI49
Source: /bin/sh (PID: 6520)	Pkill executable: /usr/bin/pkill -> pkill -9 OaF3
Source: /bin/sh (PID: 6530)	Pkill executable: /usr/bin/pkill -> pkill -9 geae
Source: /bin/sh (PID: 6537)	Pkill executable: /usr/bin/pkill -> pkill -9 vaiolmao
Source: /bin/sh (PID: 6544)	Pkill executable: /usr/bin/pkill -> pkill -9 123123a
Source: /bin/sh (PID: 6553)	Pkill executable: /usr/bin/pkill -> pkill -9 Ofurain0n4H34D
Source: /bin/sh (PID: 6560)	Pkill executable: /usr/bin/pkill -> pkill -9 ggTrex
Source: /bin/sh (PID: 6566)	Pkill executable: /usr/bin/pkill -> pkill -9 wasads
Source: /bin/sh (PID: 6576)	Pkill executable: /usr/bin/pkill -> pkill -9 1293194hjXD
Source: /bin/sh (PID: 6585)	Pkill executable: /usr/bin/pkill -> pkill -9 OthLaLosn
Source: /bin/sh (PID: 6592)	Pkill executable: /usr/bin/pkill -> pkill -9 ggt
Source: /bin/sh (PID: 6601)	Pkill executable: /usr/bin/pkill -> pkill -9 wget-log
Source: /bin/sh (PID: 6608)	Pkill executable: /usr/bin/pkill -> pkill -9 1337SoraLOADER
Source: /bin/sh (PID: 6615)	Pkill executable: /usr/bin/pkill -> pkill -9 SAIAKINA
Source: /bin/sh (PID: 6621)	Pkill executable: /usr/bin/pkill -> pkill -9 ggtq
Source: /bin/sh (PID: 6631)	Pkill executable: /usr/bin/pkill -> pkill -9 1378bfp919GRB1Q2
Source: /bin/sh (PID: 6640)	Pkill executable: /usr/bin/pkill -> pkill -9 SAIAKUSO
Source: /bin/sh (PID: 6647)	Pkill executable: /usr/bin/pkill -> pkill -9 ggtr
Source: /bin/sh (PID: 6653)	Pkill executable: /usr/bin/pkill -> pkill -9 14Fa
Source: /bin/sh (PID: 6660)	Pkill executable: /usr/bin/pkill -> pkill -9 SEXSLAVE1337
Source: /bin/sh (PID: 6666)	Pkill executable: /usr/bin/pkill -> pkill -9 ggtt
Source: /bin/sh (PID: 6673)	Pkill executable: /usr/bin/pkill -> pkill -9 1902a3u912u3u4

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: IRC traffic on port 38752 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 38754 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 38756 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 38758 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 38760 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 38762 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 38764 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 38766 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 38768 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 38770 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 38772 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 38774 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 38776 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 38778 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 38780 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 38782 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 38784 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 38784 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 38784 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 38786 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 38788 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 38790 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 38792 -> 6780

Source: /usr/bin/pkill (PID: 6275)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6284)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6289)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6295)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6299)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6305)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6309)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6319)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6348)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6354)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6362)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6368)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6375)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6381)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6385)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6394)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6400)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6404)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6410)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6417)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6423)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6432)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6438)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6442)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6450)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6456)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6460)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6466)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6475)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6484)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6488)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6497)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6503)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6512)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6520)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6530)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6537)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6544)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6553)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6560)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6566)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6576)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6585)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6592)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6601)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6608)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6615)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6621)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6631)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6640)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6647)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6653)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6660)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6666)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6673)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Source: /tmp/yakuza.m68k.elf (PID: 6261)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 6276)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 6285)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 6292)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 6296)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 6300)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 6306)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 6310)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 6320)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 6349)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 6355)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 6363)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 6369)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 6376)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 6382)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 6387)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 6397)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6401)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6407)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6411)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6418)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6424)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6433)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6439)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6443)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6453)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6457)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6463)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6467)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6478)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6485)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6489)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6498)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6505)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6514)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6521)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6531)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6538)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6547)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6554)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6563)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6568)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6577)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6586)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6593)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6602)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6609)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6618)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6624)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6632)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6641)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6648)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6654)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6661)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6667)	Queries kernel information via 'uname':

Source: yakuza.m68k.elf, 6261.1.00007ffc08b87000.00007ffc08ba8000.rw-.sdmp	Binary or memory string: Hx86_64/usr/bin/qemu-m68k/tmp/yakuza.m68k.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/yakuza.m68k.elf
Source: yakuza.m68k.elf, 6261.1.000055dab594f000.000055dab59b3000.rw-.sdmp	Binary or memory string: U!/etc/qemu-binfmt/m68k
Source: yakuza.m68k.elf, 6261.1.00007ffc08b87000.00007ffc08ba8000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-m68k
Source: yakuza.m68k.elf, 6261.1.000055dab594f000.000055dab59b3000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/m68k

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: yakuza.m68k.elf, type: SAMPLE
Source: Yara match	File source: 6261.1.00007f14ac001000.00007f14ac01e000.r-x.sdmp, type: MEMORY

Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:48.0) Gecko/20100101 Firefox/48.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en; rv:1.8.1.11) Gecko/20071128 Camino/1.5.4
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; rv:2.2) Gecko/20110201
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; cs; rv:1.9.2.6) Gecko/20100628 myibrow/4alpha2
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Win 9x 4.90; SG; rv:1.9.2.4) Gecko/20101104 Netscape/9.1.0285
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.2.0 Lightning/4.0.2
Source: Initial sample	User agent string found: Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U;) Presto/2.7.62 Version/11.01
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; Linux x86_64; U; de; rv:1.9.1.6) Gecko/20091201 Firefox/3.5.6 Opera 10.62
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Linux; Android 4.4.3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.89 Mobile Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0) Gecko/20110517 Firefox/5.0 Fennec/5.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Android; Linux armv7l; rv:9.0) Gecko/20111216 Firefox/9.0 Fennec/9.0
Source: Initial sample	User agent string found: Mozilla/5.0 (compatible; Teleca Q7; Brew 3.1.5; U; en) 480X800 LGE VX11000

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: yakuza.m68k.elf, type: SAMPLE
Source: Yara match	File source: 6261.1.00007f14ac001000.00007f14ac01e000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 Masquerading	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	1 Brute Force	1 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
yakuza.m68k.elf	58%	ReversingLabs	Linux.Trojan.Tsunami

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://youtu.be/dQw4w9WgXcQ	yakuza.m68k.elf	false	high
http://linux-it.abuser.eu/yak.sh;	yakuza.m68k.elf	false	unknown
https://youtu.be/dQw4w9WgXcQNever	yakuza.m68k.elf	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
95.234.158.87	unknown	Italy	3269	ASN-IBSNAZIT	true
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.43	linux_arm5.elf	Get hash	malicious	Unknown	Browse
	la.bot.arc.elf	Get hash	malicious	Mirai	Browse
	la.bot.m68k.elf	Get hash	malicious	Unknown	Browse
	la.bot.arc.elf	Get hash	malicious	Mirai	Browse
	la.bot.arm.elf	Get hash	malicious	Unknown	Browse
	la.bot.mipsel.elf	Get hash	malicious	Unknown	Browse
	la.bot.arm7.elf	Get hash	malicious	Unknown	Browse
	x86.elf	Get hash	malicious	Unknown	Browse
	arm6.elf	Get hash	malicious	Unknown	Browse
	m68k.elf	Get hash	malicious	Unknown	Browse
91.189.91.42	linux_arm5.elf	Get hash	malicious	Unknown	Browse
	la.bot.arc.elf	Get hash	malicious	Mirai	Browse
	la.bot.m68k.elf	Get hash	malicious	Unknown	Browse
	la.bot.arc.elf	Get hash	malicious	Mirai	Browse
	la.bot.arm.elf	Get hash	malicious	Unknown	Browse
	la.bot.mipsel.elf	Get hash	malicious	Unknown	Browse
	la.bot.arm7.elf	Get hash	malicious	Unknown	Browse
	x86.elf	Get hash	malicious	Unknown	Browse
	arm6.elf	Get hash	malicious	Unknown	Browse
	m68k.elf	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	linux_arm5.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	la.bot.arc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	la.bot.m68k.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	la.bot.arc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	la.bot.arm.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	la.bot.mipsel.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	la.bot.arm7.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	x86.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	arm6.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	m68k.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
INIT7CH	linux_arm5.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	la.bot.arc.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	la.bot.m68k.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	la.bot.arc.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	la.bot.arm.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	la.bot.mipsel.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	la.bot.arm7.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	x86.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	arm6.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	m68k.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
ASN-IBSNAZIT	sparc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	131.1.112.117
	sh4.elf	Get hash	malicious	Mirai, Moobot	Browse	79.16.25.108
	mpsl.elf	Get hash	malicious	Mirai, Moobot	Browse	95.224.165.124
	powerpc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	79.58.184.246
	mips.elf	Get hash	malicious	Mirai, Moobot	Browse	79.39.13.191
	arm.elf	Get hash	malicious	Mirai, Moobot	Browse	2.114.140.56
	m68k.elf	Get hash	malicious	Mirai, Moobot	Browse	87.16.92.237
	arm7.elf	Get hash	malicious	Mirai, Moobot	Browse	95.235.74.87
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	80.181.217.0
	mipsel.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	79.62.54.196

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit MSB executable, Motorola m68k, 68020, version 1 (SYSV), statically linked, not stripped
Entropy (8bit):	6.192609548429807
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	yakuza.m68k.elf
File size:	148'432 bytes
MD5:	6f29cf16208a5a65d64fc40d9f161210
SHA1:	19642cf4cb5e7df090d2268d5e89f87c8df4baa9
SHA256:	5e6e4b917fdd5275e837fe3440fbb1b1bcb48dc4564f66dea69bdb43e4820f65
SHA512:	d01aaa507293cb2cd186c8662cee5f09b380577bfe4654ab7957dbbb386abbcec9c8b1958aa81d1d0b1a8d68d22f51df65aa48f8f85b82e720a918c6ef4eccf3
SSDEEP:	3072:RGOb6sTmB8YNT6WyKphl7wXuOGT87SU221v2vKWnDf49/1TpPI:9b6sTmDNfyKnl7wXu6+212vKWnDf4J1G
TLSH:	32E33B82FD00DE76F41A967645D74B29B370AB624F531672631B39AADE372C0382BF05
File Content Preview:	.ELF.......................D...4...$.....4. ...(.................................. ........................\|...... .dt.Q............................NV..a....da...o\|N^NuNV..J9...tf>"y.... QJ.g.X.#.....N."y.... QJ.f.A.....J.g.Hy....N.X........tN^NuNV..N^NuN

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	MC68000
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x80000144
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	122148
Section Header Size:	40
Number of Section Headers:	15
Header String Table Index:	12

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x80000094	0x94	0x14	0x0	0x6	AX	0	0	2
.text	PROGBITS	0x800000a8	0xa8	0x16fa8	0x0	0x6	AX	0	0	4
.fini	PROGBITS	0x80017050	0x17050	0xe	0x0	0x6	AX	0	0	2
.rodata	PROGBITS	0x8001705e	0x1705e	0x5184	0x0	0x2	A	0	0	2
.eh_frame	PROGBITS	0x8001c1e4	0x1c1e4	0x4	0x0	0x2	A	0	0	4
.ctors	PROGBITS	0x8001e1e8	0x1c1e8	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x8001e1f0	0x1c1f0	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x8001e1f8	0x1c1f8	0x4	0x0	0x3	WA	0	0	4
.data	PROGBITS	0x8001e1fc	0x1c1fc	0xd78	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x8001ef74	0x1cf74	0x77f0	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x1cf74	0xd4a	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x1dcbe	0x66	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x1df7c	0x39a0	0x10	0x0		14	324	4
.strtab	STRTAB	0x0	0x2191c	0x2ab4	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x80000000	0x80000000	0x1c1e8	0x1c1e8	6.2105	0x5	R E	0x2000	.init .text .fini .rodata .eh_frame
LOAD	0x1c1e8	0x8001e1e8	0x8001e1e8	0xd8c	0x857c	4.6799	0x6	RW	0x2000	.ctors .dtors .jcr .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x80000094	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x800000a8	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x80017050	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x8001705e	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x8001c1e4	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x8001e1e8	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x8001e1f0	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x8001e1f8	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x8001e1fc	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x8001ef74	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	14
C.89.5703	.symtab	0x8001925a	312	OBJECT	<unknown>	DEFAULT	4
ClearHistory	.symtab	0x80005a2a	50	FUNC	<unknown>	DEFAULT	2
HTTP	.symtab	0x8000203e	274	FUNC	<unknown>	DEFAULT	2
Q	.symtab	0x8001f3aa	16384	OBJECT	<unknown>	DEFAULT	10
Send	.symtab	0x8000033a	78	FUNC	<unknown>	DEFAULT	2
UserAgents	.symtab	0x8001e530	144	OBJECT	<unknown>	DEFAULT	9
_352	.symtab	0x80006ebc	8	FUNC	<unknown>	DEFAULT	2
_376	.symtab	0x80006e22	122	FUNC	<unknown>	DEFAULT	2
_433	.symtab	0x80006ec4	58	FUNC	<unknown>	DEFAULT	2
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_NICK	.symtab	0x80006efe	174	FUNC	<unknown>	DEFAULT	2
_PING	.symtab	0x80006e9c	32	FUNC	<unknown>	DEFAULT	2
_PRIVMSG	.symtab	0x8000639e	2692	FUNC	<unknown>	DEFAULT	2
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x8001e1ec	0	OBJECT	<unknown>	DEFAULT	6
__CTOR_LIST__	.symtab	0x8001e1e8	0	OBJECT	<unknown>	DEFAULT	6
__C_ctype_b	.symtab	0x8001ef18	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x8001ba9c	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x8001ef20	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x8001bd9c	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x8001ebfc	4	OBJECT	<unknown>	DEFAULT	9
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x8001aa78	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x8001e1f4	0	OBJECT	<unknown>	DEFAULT	7
__DTOR_LIST__	.symtab	0x8001e1f0	0	OBJECT	<unknown>	DEFAULT	7
__EH_FRAME_BEGIN__	.symtab	0x8001c1e4	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x8001c1e4	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x8001ef18	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_b_data	.symtab	0x8001ba9c	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_tolower	.symtab	0x8001ef20	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_tolower_data	.symtab	0x8001bd9c	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_toupper	.symtab	0x8001ebfc	4	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_toupper_data	.symtab	0x8001aa78	768	OBJECT	<unknown>	HIDDEN	4
__GI___ctype_b	.symtab	0x8001ef1c	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_tolower	.symtab	0x8001ef24	4	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_toupper	.symtab	0x8001ec00	4	OBJECT	<unknown>	HIDDEN	9
__GI___errno_location	.symtab	0x800082e0	16	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x800128bc	500	FUNC	<unknown>	HIDDEN	2
__GI___fputc_unlocked	.symtab	0x8000adf8	392	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x8000bcf0	36	FUNC	<unknown>	HIDDEN	2
__GI___h_errno_location	.symtab	0x8001154c	16	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x80007b30	188	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl64	.symtab	0x80007c44	54	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x800112da	80	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x80010be4	106	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x80010d00	74	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x8000bd14	264	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x80011040	16	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x80015794	390	FUNC	<unknown>	HIDDEN	2
__GI_accept	.symtab	0x8000e8f0	50	FUNC	<unknown>	HIDDEN	2
__GI_asprintf	.symtab	0x80008604	48	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x8000fe68	28	FUNC	<unknown>	HIDDEN	2
__GI_atol	.symtab	0x8000fe68	28	FUNC	<unknown>	HIDDEN	2
__GI_bind	.symtab	0x8000e924	48	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x80015948	64	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0x80007cba	16	FUNC	<unknown>	HIDDEN	2
__GI_clock_getres	.symtab	0x80011050	78	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x80007ccc	60	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x8000e954	48	FUNC	<unknown>	HIDDEN	2
__GI_dup2	.symtab	0x800110a0	72	FUNC	<unknown>	HIDDEN	2
__GI_endservent	.symtab	0x80013944	108	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x80025418	4	OBJECT	<unknown>	HIDDEN	10
__GI_execl	.symtab	0x80010178	178	FUNC	<unknown>	HIDDEN	2
__GI_execve	.symtab	0x800110e8	84	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x800100fc	124	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x800082f0	416	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x80007b30	188	FUNC	<unknown>	HIDDEN	2
__GI_fcntl64	.symtab	0x80007c44	54	FUNC	<unknown>	HIDDEN	2
__GI_fdopen	.symtab	0x800116b8	78	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x8000ab16	510	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x800128bc	500	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x8000a7c0	134	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x8000ad14	226	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x80008490	38	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x80007d08	56	FUNC	<unknown>	HIDDEN	2
__GI_fprintf	.symtab	0x800085d4	48	FUNC	<unknown>	HIDDEN	2
__GI_fputc	.symtab	0x8000a848	284	FUNC	<unknown>	HIDDEN	2
__GI_fputs	.symtab	0x8000a964	124	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x8000af80	80	FUNC	<unknown>	HIDDEN	2
__GI_freeaddrinfo	.symtab	0x8000d30c	44	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x800159e8	40	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x80015a98	346	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x8000afd0	162	FUNC	<unknown>	HIDDEN	2
__GI_getaddrinfo	.symtab	0x8000d338	764	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x800128bc	500	FUNC	<unknown>	HIDDEN	2
__GI_getcwd	.symtab	0x80007d40	298	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x80007e6c	52	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x8001113c	60	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x80011178	60	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x800111b4	60	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyaddr_r	.symtab	0x8000e3fc	1268	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2_r	.symtab	0x8000e01c	990	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x80015010	1164	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x80007ea0	42	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x80007ecc	56	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x80007f3c	90	FUNC	<unknown>	HIDDEN	2
__GI_getservbyname_r	.symtab	0x80013b4c	276	FUNC	<unknown>	HIDDEN	2
__GI_getservbyport	.symtab	0x80013b10	60	FUNC	<unknown>	HIDDEN	2
__GI_getservbyport_r	.symtab	0x80013a3c	212	FUNC	<unknown>	HIDDEN	2
__GI_getservent_r	.symtab	0x80013632	734	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x800111f0	60	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x8002541c	4	OBJECT	<unknown>	HIDDEN	10
__GI_if_freenameindex	.symtab	0x80014048	72	FUNC	<unknown>	HIDDEN	2
__GI_if_nameindex	.symtab	0x80013de0	616	FUNC	<unknown>	HIDDEN	2
__GI_if_nametoindex	.symtab	0x80013d46	154	FUNC	<unknown>	HIDDEN	2
__GI_in6addr_loopback	.symtab	0x8001ba20	16	OBJECT	<unknown>	HIDDEN	4
__GI_inet_addr	.symtab	0x8000dfec	48	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x80014090	362	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa	.symtab	0x8000dfcc	30	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa_r	.symtab	0x8000df2c	160	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x8000deba	112	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x8000d9c8	96	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x8000fb9e	330	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x80007f98	130	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x8000bfd4	52	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x80008064	20	FUNC	<unknown>	HIDDEN	2
__GI_listen	.symtab	0x8000e9c8	42	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x80016dda	108	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x80012ab0	348	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x8000b49e	240	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x800130cc	288	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x800131ec	42	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x80013218	358	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x8000b590	310	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x8001122c	78	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x800112da	80	FUNC	<unknown>	HIDDEN	2
__GI_perror	.symtab	0x800084b8	74	FUNC	<unknown>	HIDDEN	2
__GI_pipe	.symtab	0x80011348	62	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x80008078	88	FUNC	<unknown>	HIDDEN	2
__GI_putc	.symtab	0x8000a848	284	FUNC	<unknown>	HIDDEN	2
__GI_putc_unlocked	.symtab	0x8000adf8	392	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x80016d5c	28	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x8000f5b8	94	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x8000f8ee	266	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x80015f88	274	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x80016e48	84	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x8000e9f4	56	FUNC	<unknown>	HIDDEN	2
__GI_rewind	.symtab	0x80015a10	134	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x80011388	106	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x800080d0	100	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x8000ea2c	56	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x8000ea64	70	FUNC	<unknown>	HIDDEN	2
__GI_setservent	.symtab	0x800139b0	140	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x80008134	56	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x8000eaac	64	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x8000f758	406	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x800154e0	232	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x800155c8	238	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x800113f4	160	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x8001022c	558	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x8000eaec	50	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x80008634	52	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x8000f9f8	422	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x8000be3c	120	FUNC	<unknown>	HIDDEN	2
__GI_strcasestr	.symtab	0x8000beb4	170	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x80013380	390	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x8000b6c8	110	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x8000b6c8	110	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x8000b738	92	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x8000bf60	80	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x8000b794	268	FUNC	<unknown>	HIDDEN	2
__GI_strncat	.symtab	0x8001609c	310	FUNC	<unknown>	HIDDEN	2
__GI_strncmp	.symtab	0x8000b8a0	430	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x8000ba50	320	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x8000bb90	350	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x800135a4	86	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x800161d4	104	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x8000bfb0	36	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x80013508	154	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x8000fe84	34	FUNC	<unknown>	HIDDEN	2
__GI_strtoul	.symtab	0x8000fea8	32	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x8001045c	1782	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x8000c008	182	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x8000816c	62	FUNC	<unknown>	HIDDEN	2
__GI_tolower	.symtab	0x8001150c	64	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x800082a0	64	FUNC	<unknown>	HIDDEN	2
__GI_vasprintf	.symtab	0x80008668	158	FUNC	<unknown>	HIDDEN	2
__GI_vfork	.symtab	0x80010f94	38	FUNC	<unknown>	HIDDEN	2
__GI_vfprintf	.symtab	0x800090c4	182	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x80008708	198	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x800114ee	30	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x80008228	34	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x8001155c	100	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x800115e8	206	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x800115c0	38	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x8000824c	84	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x8001e1f8	0	OBJECT	<unknown>	DEFAULT	8
__JCR_LIST__	.symtab	0x8001e1f8	0	OBJECT	<unknown>	DEFAULT	8
__app_fini	.symtab	0x8002540c	4	OBJECT	<unknown>	HIDDEN	10
__atexit_lock	.symtab	0x8001eefc	24	OBJECT	<unknown>	DEFAULT	9
__bsd_signal	.symtab	0x800155c8	238	FUNC	<unknown>	HIDDEN	2
__bss_start	.symtab	0x8001ef74	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x80010cbc	68	FUNC	<unknown>	DEFAULT	2
__check_pf	.symtab	0x8000c104	28	FUNC	<unknown>	DEFAULT	2
__check_suid	.symtab	0x80010c60	92	FUNC	<unknown>	DEFAULT	2
__ctype_b	.symtab	0x8001ef1c	4	OBJECT	<unknown>	DEFAULT	9
__ctype_tolower	.symtab	0x8001ef24	4	OBJECT	<unknown>	DEFAULT	9
__ctype_toupper	.symtab	0x8001ec00	4	OBJECT	<unknown>	DEFAULT	9
__curbrk	.symtab	0x8002545c	4	OBJECT	<unknown>	DEFAULT	10
__data_start	.symtab	0x8001e204	0	NOTYPE	<unknown>	DEFAULT	9
__decode_answer	.symtab	0x8001670c	460	FUNC	<unknown>	HIDDEN	2
__decode_dotted	.symtab	0x800141fc	340	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x8001642c	480	FUNC	<unknown>	HIDDEN	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__dns_lookup	.symtab	0x80014350	2224	FUNC	<unknown>	HIDDEN	2
__do_global_ctors_aux	.symtab	0x8001701c	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x800000a8	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x8001e1fc	0	OBJECT	<unknown>	HIDDEN	9
__encode_dotted	.symtab	0x80016e9c	268	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x8001623c	494	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x8001660c	198	FUNC	<unknown>	HIDDEN	2
__environ	.symtab	0x80025404	4	OBJECT	<unknown>	DEFAULT	10
__errno_location	.symtab	0x800082e0	16	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x800253fc	4	OBJECT	<unknown>	HIDDEN	10
__fgetc_unlocked	.symtab	0x800128bc	500	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x8001e1e8	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fini_array_start	.symtab	0x8001e1e8	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fputc_unlocked	.symtab	0x8000adf8	392	FUNC	<unknown>	DEFAULT	2
__free_to_heap	.symtab	0x8000edf4	342	FUNC	<unknown>	DEFAULT	2
__get_hosts_byaddr_r	.symtab	0x80014f7c	148	FUNC	<unknown>	HIDDEN	2
__get_hosts_byname_r	.symtab	0x80014f48	50	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x80007ea0	42	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x8000bcf0	36	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__h_errno_location	.symtab	0x8001154c	16	FUNC	<unknown>	DEFAULT	2
__h_errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__heap_add_free_area	.symtab	0x8000f3d2	66	FUNC	<unknown>	DEFAULT	2
__heap_alloc	.symtab	0x8000f19e	150	FUNC	<unknown>	DEFAULT	2
__heap_alloc_at	.symtab	0x8000f2ce	144	FUNC	<unknown>	DEFAULT	2
__heap_delete	.symtab	0x8000ed9c	88	FUNC	<unknown>	DEFAULT	2
__heap_delete	.symtab	0x8000f104	88	FUNC	<unknown>	DEFAULT	2
__heap_delete	.symtab	0x8000f234	88	FUNC	<unknown>	DEFAULT	2
__heap_free	.symtab	0x8000f414	404	FUNC	<unknown>	DEFAULT	2
__heap_free_area_alloc	.symtab	0x8000f15c	66	FUNC	<unknown>	DEFAULT	2
__heap_free_area_alloc	.symtab	0x8000f28c	66	FUNC	<unknown>	DEFAULT	2
__heap_link_free_area	.symtab	0x8000f360	70	FUNC	<unknown>	DEFAULT	2
__heap_link_free_area_after	.symtab	0x8000f3a6	44	FUNC	<unknown>	DEFAULT	2
__init_array_end	.symtab	0x8001e1e8	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__init_array_start	.symtab	0x8001e1e8	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__initbuf	.symtab	0x800135fc	54	FUNC	<unknown>	DEFAULT	2
__length_dotted	.symtab	0x80016fa8	114	FUNC	<unknown>	HIDDEN	2
__length_question	.symtab	0x800166d4	56	FUNC	<unknown>	HIDDEN	2
__libc_accept	.symtab	0x8000e8f0	50	FUNC	<unknown>	DEFAULT	2
__libc_close	.symtab	0x80007ccc	60	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x8000e954	48	FUNC	<unknown>	DEFAULT	2
__libc_creat	.symtab	0x8001132a	30	FUNC	<unknown>	DEFAULT	2
__libc_fcntl	.symtab	0x80007b30	188	FUNC	<unknown>	DEFAULT	2
__libc_fcntl64	.symtab	0x80007c44	54	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x80007d08	56	FUNC	<unknown>	DEFAULT	2
__libc_getpid	.symtab	0x80007ecc	56	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0x80016dda	108	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x8001122c	78	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x800112da	80	FUNC	<unknown>	DEFAULT	2
__libc_poll	.symtab	0x80008078	88	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x80016e48	84	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x8000e9f4	56	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x800080d0	100	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x8000ea2c	56	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x8000ea64	70	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x800154e0	232	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x80025400	4	OBJECT	<unknown>	DEFAULT	10
__libc_system	.symtab	0x8000fce8	382	FUNC	<unknown>	DEFAULT	2
__libc_waitpid	.symtab	0x80008228	34	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x8000824c	84	FUNC	<unknown>	DEFAULT	2
__malloc_from_heap	.symtab	0x8000eb20	466	FUNC	<unknown>	DEFAULT	2
__malloc_heap	.symtab	0x8001ed40	4	OBJECT	<unknown>	DEFAULT	9
__malloc_heap_lock	.symtab	0x800253e4	24	OBJECT	<unknown>	DEFAULT	10
__malloc_sbrk_lock	.symtab	0x800266a0	24	OBJECT	<unknown>	DEFAULT	10
__nameserver	.symtab	0x800266c8	12	OBJECT	<unknown>	HIDDEN	10
__nameservers	.symtab	0x800266d4	4	OBJECT	<unknown>	HIDDEN	10
__open_etc_hosts	.symtab	0x800168d8	72	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x80014c00	840	FUNC	<unknown>	HIDDEN	2
__opensock	.symtab	0x8001549c	66	FUNC	<unknown>	HIDDEN	2
__pagesize	.symtab	0x80025408	4	OBJECT	<unknown>	DEFAULT	10
__preinit_array_end	.symtab	0x8001e1e8	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__preinit_array_start	.symtab	0x8001e1e8	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__pthread_initialize_minimal	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x80010c4e	10	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x80010c4e	10	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x80010c4e	10	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x80010c4e	10	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x80010c4e	10	FUNC	<unknown>	DEFAULT	2
__pthread_return_void	.symtab	0x80010c58	8	FUNC	<unknown>	DEFAULT	2
__raise	.symtab	0x80016d5c	28	FUNC	<unknown>	HIDDEN	2
__read_etc_hosts_r	.symtab	0x80016920	1084	FUNC	<unknown>	HIDDEN	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__resolv_lock	.symtab	0x8001ef44	24	OBJECT	<unknown>	DEFAULT	9
__rtld_fini	.symtab	0x80025410	4	OBJECT	<unknown>	HIDDEN	10
__searchdomain	.symtab	0x800266b8	16	OBJECT	<unknown>	HIDDEN	10
__searchdomains	.symtab	0x800266d8	4	OBJECT	<unknown>	HIDDEN	10
__sigaddset	.symtab	0x80015708	68	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x8001574c	72	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x800156b8	80	FUNC	<unknown>	DEFAULT	2
__socketcall	.symtab	0x80010fbc	74	FUNC	<unknown>	HIDDEN	2
__socketcall.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__stdin	.symtab	0x8001ec10	4	OBJECT	<unknown>	DEFAULT	9
__stdio_READ	.symtab	0x80015bf4	138	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x80011708	314	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x80015c80	352	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x80011844	518	FUNC	<unknown>	HIDDEN	2
__stdio_init_mutex	.symtab	0x80008f38	32	FUNC	<unknown>	HIDDEN	2
__stdio_mutex_initializer.3828	.symtab	0x8001ad92	24	OBJECT	<unknown>	DEFAULT	4
__stdio_rfill	.symtab	0x80015de0	90	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x80015f20	102	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x80015e3c	226	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x80011a4c	414	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x80009050	116	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x8001ec14	4	OBJECT	<unknown>	DEFAULT	9
__syscall_chdir	.symtab	0x80007c7c	62	FUNC	<unknown>	DEFAULT	2
__syscall_exit	.symtab	0x80011008	56	FUNC	<unknown>	DEFAULT	2
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl64	.symtab	0x80007bec	88	FUNC	<unknown>	DEFAULT	2
__syscall_fcntl64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_kill	.symtab	0x8000801c	72	FUNC	<unknown>	DEFAULT	2
__syscall_llseek	.symtab	0x80016d78	98	FUNC	<unknown>	DEFAULT	2
__syscall_open	.symtab	0x8001127c	94	FUNC	<unknown>	DEFAULT	2
__syscall_rt_sigaction	.symtab	0x80015988	94	FUNC	<unknown>	HIDDEN	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_umask	.symtab	0x800081ac	88	FUNC	<unknown>	DEFAULT	2
__syscall_wait4	.symtab	0x80011494	90	FUNC	<unknown>	DEFAULT	2
__uClibc_fini	.symtab	0x80010be4	106	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x80010d00	74	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x80010d4a	584	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x8001ef14	4	OBJECT	<unknown>	HIDDEN	9
__vfork	.symtab	0x80010f94	38	FUNC	<unknown>	HIDDEN	2
__xpg_strerror_r	.symtab	0x8000bd14	264	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_charpad	.symtab	0x8000917c	74	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_dl_aux_init	.symtab	0x8001591c	44	FUNC	<unknown>	DEFAULT	2
_dl_phdr	.symtab	0x8002675c	4	OBJECT	<unknown>	DEFAULT	10
_dl_phnum	.symtab	0x80026760	4	OBJECT	<unknown>	DEFAULT	10
_do_one_spec	.symtab	0x8000926e	2118	FUNC	<unknown>	DEFAULT	2
_edata	.symtab	0x8001ef74	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x80026764	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno	.symtab	0x80025418	4	OBJECT	<unknown>	DEFAULT	10
_exit	.symtab	0x80011040	16	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x80017050	0	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x800233d0	8192	OBJECT	<unknown>	DEFAULT	10
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x800091c6	168	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x80011ef4	2502	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_h_errno	.symtab	0x8002541c	4	OBJECT	<unknown>	DEFAULT	10
_init	.symtab	0x80000094	0	FUNC	<unknown>	DEFAULT	1
_is_equal_or_bigger_arg	.symtab	0x8000a0a8	102	FUNC	<unknown>	DEFAULT	2
_load_inttype	.symtab	0x80011bec	238	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_init	.symtab	0x80009c48	208	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x8000a10e	1584	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x80009d18	108	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x80009d84	718	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x8000a054	84	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x80010c58	8	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x80010c58	8	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_sigintr	.symtab	0x800266dc	128	OBJECT	<unknown>	HIDDEN	10
_start	.symtab	0x80000144	0	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x80008b10	960	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x80008ed0	104	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x8001ec18	4	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_add_lock	.symtab	0x8001ec1c	24	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_dec_use	.symtab	0x8000a9e0	310	FUNC	<unknown>	DEFAULT	2
_stdio_openlist_del_count	.symtab	0x800233cc	4	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_del_lock	.symtab	0x8001ec34	24	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_use_count	.symtab	0x800233c8	4	OBJECT	<unknown>	DEFAULT	10
_stdio_streams	.symtab	0x8001ec50	240	OBJECT	<unknown>	DEFAULT	9
_stdio_term	.symtab	0x80008f58	248	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x8001ec4c	4	OBJECT	<unknown>	DEFAULT	9
_stdlib_strto_l	.symtab	0x8000fec8	562	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x80011cdc	96	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x8001ae56	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x80011d3c	438	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x80009ab4	404	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wordcopy_bwd_aligned	.symtab	0x80012c0c	638	FUNC	<unknown>	DEFAULT	2
_wordcopy_bwd_dest_aligned	.symtab	0x80012e8a	578	FUNC	<unknown>	DEFAULT	2
_wordcopy_fwd_aligned	.symtab	0x8000b074	566	FUNC	<unknown>	DEFAULT	2
_wordcopy_fwd_dest_aligned	.symtab	0x8000b2aa	500	FUNC	<unknown>	DEFAULT	2
abort	.symtab	0x80015794	390	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
accept	.symtab	0x8000e8f0	50	FUNC	<unknown>	DEFAULT	2
accept.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
actualparent	.symtab	0x80025574	4	OBJECT	<unknown>	DEFAULT	10
addrconfig	.symtab	0x8000d268	164	FUNC	<unknown>	DEFAULT	2
advance_telstate	.symtab	0x80004260	84	FUNC	<unknown>	DEFAULT	2
advances	.symtab	0x8001ea60	28	OBJECT	<unknown>	DEFAULT	9
advances2	.symtab	0x8001eac0	44	OBJECT	<unknown>	DEFAULT	9
ak47scan	.symtab	0x80005776	190	FUNC	<unknown>	DEFAULT	2
ak47scantoggle	.symtab	0x80005834	368	FUNC	<unknown>	DEFAULT	2
ak47telscan	.symtab	0x80004300	5238	FUNC	<unknown>	DEFAULT	2
append	.symtab	0x80006052	48	FUNC	<unknown>	DEFAULT	2
asprintf	.symtab	0x80008604	48	FUNC	<unknown>	DEFAULT	2
asprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
atoi	.symtab	0x8000fe68	28	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x8000fe68	28	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bcopy	.symtab	0x8000be1c	30	FUNC	<unknown>	DEFAULT	2
bcopy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
been_there_done_that	.symtab	0x80025458	4	OBJECT	<unknown>	DEFAULT	10
been_there_done_that.2790	.symtab	0x80025414	4	OBJECT	<unknown>	DEFAULT	10
bind	.symtab	0x8000e924	48	FUNC	<unknown>	DEFAULT	2
bind.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
blacknurse	.symtab	0x800013ce	784	FUNC	<unknown>	DEFAULT	2
botkill	.symtab	0x800059a4	134	FUNC	<unknown>	DEFAULT	2
brk	.symtab	0x80015948	64	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x800155c8	238	FUNC	<unknown>	DEFAULT	2
buf.2603	.symtab	0x800253d4	16	OBJECT	<unknown>	DEFAULT	10
c	.symtab	0x8001eafc	4	OBJECT	<unknown>	DEFAULT	9
call___do_global_ctors_aux	.symtab	0x80017046	0	FUNC	<unknown>	DEFAULT	2
call___do_global_dtors_aux	.symtab	0x800000f6	0	FUNC	<unknown>	DEFAULT	2
call_frame_dummy	.symtab	0x8000013c	0	FUNC	<unknown>	DEFAULT	2
capsaicin2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
chan	.symtab	0x80026698	4	OBJECT	<unknown>	DEFAULT	10
changeservers	.symtab	0x8001ef94	4	OBJECT	<unknown>	DEFAULT	10
chdir	.symtab	0x80007cba	16	FUNC	<unknown>	DEFAULT	2
chdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
clock_getres	.symtab	0x80011050	78	FUNC	<unknown>	DEFAULT	2
clock_getres.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x80007ccc	60	FUNC	<unknown>	DEFAULT	2
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
completed.2170	.symtab	0x8001ef74	1	OBJECT	<unknown>	DEFAULT	10
con	.symtab	0x80006fac	648	FUNC	<unknown>	DEFAULT	2
connect	.symtab	0x8000e954	48	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
contains_fail	.symtab	0x800040ae	26	FUNC	<unknown>	DEFAULT	2
contains_response	.symtab	0x800040c8	56	FUNC	<unknown>	DEFAULT	2
contains_string	.symtab	0x80004026	110	FUNC	<unknown>	DEFAULT	2
contains_success	.symtab	0x80004094	26	FUNC	<unknown>	DEFAULT	2
creat	.symtab	0x8001132a	30	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum	.symtab	0x8000017c	144	FUNC	<unknown>	DEFAULT	2
data_start	.symtab	0x8001e204	0	NOTYPE	<unknown>	DEFAULT	9
decodea.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
disable	.symtab	0x80000faa	268	FUNC	<unknown>	DEFAULT	2
disabled	.symtab	0x8001ef98	1	OBJECT	<unknown>	DEFAULT	10
dispass	.symtab	0x80025460	256	OBJECT	<unknown>	DEFAULT	10
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dns	.symtab	0x80003312	602	FUNC	<unknown>	DEFAULT	2
dns_format	.symtab	0x80002cd2	170	FUNC	<unknown>	DEFAULT	2
dns_hdr_create	.symtab	0x80002d7c	104	FUNC	<unknown>	DEFAULT	2
dns_send	.symtab	0x80002de4	954	FUNC	<unknown>	DEFAULT	2
dnsflood	.symtab	0x8000319e	372	FUNC	<unknown>	DEFAULT	2
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
download	.symtab	0x80000978	1004	FUNC	<unknown>	DEFAULT	2
dup2	.symtab	0x800110a0	72	FUNC	<unknown>	DEFAULT	2
dup2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
enable	.symtab	0x800010b6	218	FUNC	<unknown>	DEFAULT	2
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
endservent	.symtab	0x80013944	108	FUNC	<unknown>	DEFAULT	2
environ	.symtab	0x80025404	4	OBJECT	<unknown>	DEFAULT	10
errno	.symtab	0x80025418	4	OBJECT	<unknown>	DEFAULT	10
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execfile	.symtab	0x80025580	256	OBJECT	<unknown>	DEFAULT	10
execl	.symtab	0x80010178	178	FUNC	<unknown>	DEFAULT	2
execl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execve	.symtab	0x800110e8	84	FUNC	<unknown>	DEFAULT	2
execve.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x800100fc	124	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x8001c0f8	108	OBJECT	<unknown>	DEFAULT	4
fails	.symtab	0x8001ea7c	36	OBJECT	<unknown>	DEFAULT	9
fastflux	.symtab	0x800061fa	420	FUNC	<unknown>	DEFAULT	2
fclose	.symtab	0x800082f0	416	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x80007b30	188	FUNC	<unknown>	DEFAULT	2
fcntl64	.symtab	0x80007c44	54	FUNC	<unknown>	DEFAULT	2
fdopen	.symtab	0x800116b8	78	FUNC	<unknown>	DEFAULT	2
fdopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
feof	.symtab	0x8000a740	126	FUNC	<unknown>	DEFAULT	2
feof.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fflush_unlocked	.symtab	0x8000ab16	510	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x800128bc	500	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x8000a7c0	134	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x8000ad14	226	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
filter	.symtab	0x80000476	88	FUNC	<unknown>	DEFAULT	2
fix_errno	.symtab	0x80010fac	0	NOTYPE	<unknown>	DEFAULT	2
flooders	.symtab	0x8001eb0c	176	OBJECT	<unknown>	DEFAULT	9
fmt	.symtab	0x8001c0e4	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x80008490	38	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0x80007d08	56	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fprintf	.symtab	0x800085d4	48	FUNC	<unknown>	DEFAULT	2
fprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputc	.symtab	0x8000a848	284	FUNC	<unknown>	DEFAULT	2
fputc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputc_unlocked	.symtab	0x8000adf8	392	FUNC	<unknown>	DEFAULT	2
fputc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs	.symtab	0x8000a964	124	FUNC	<unknown>	DEFAULT	2
fputs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs_unlocked	.symtab	0x8000af80	80	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x800000fe	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x8000ef4a	32	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
freeaddrinfo	.symtab	0x8000d30c	44	FUNC	<unknown>	DEFAULT	2
fseek	.symtab	0x800159e8	40	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x800159e8	40	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x80015a98	346	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fwrite_unlocked	.symtab	0x8000afd0	162	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gaih	.symtab	0x8001b9b0	24	OBJECT	<unknown>	DEFAULT	4
gaih_inet	.symtab	0x8000c216	4178	FUNC	<unknown>	DEFAULT	2
gaih_inet_serv	.symtab	0x8000c120	246	FUNC	<unknown>	DEFAULT	2
gaih_inet_typeproto	.symtab	0x8001b9c8	35	OBJECT	<unknown>	DEFAULT	4
get	.symtab	0x80000d64	252	FUNC	<unknown>	DEFAULT	2
getBuild	.symtab	0x8000016c	16	FUNC	<unknown>	DEFAULT	2
getDatIP	.symtab	0x80003a96	1126	FUNC	<unknown>	DEFAULT	2
getHost	.symtab	0x80001dcc	56	FUNC	<unknown>	DEFAULT	2
getPublicIP	.symtab	0x8000611c	136	FUNC	<unknown>	DEFAULT	2
get_hosts_byaddr_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
get_telstate_host	.symtab	0x8000423c	36	FUNC	<unknown>	DEFAULT	2
getaddrinfo	.symtab	0x8000d338	764	FUNC	<unknown>	DEFAULT	2
getaddrinfo.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getc_unlocked	.symtab	0x800128bc	500	FUNC	<unknown>	DEFAULT	2
getcwd	.symtab	0x80007d40	298	FUNC	<unknown>	DEFAULT	2
getcwd.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdtablesize	.symtab	0x80007e6c	52	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x8001113c	60	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x80011178	60	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x800111b4	60	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyaddr_r	.symtab	0x8000e3fc	1268	FUNC	<unknown>	DEFAULT	2
gethostbyaddr_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2_r	.symtab	0x8000e01c	990	FUNC	<unknown>	DEFAULT	2
gethostbyname2_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0x80015010	1164	FUNC	<unknown>	DEFAULT	2
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getmyip	.symtab	0x800061a4	86	FUNC	<unknown>	DEFAULT	2
getpagesize	.symtab	0x80007ea0	42	FUNC	<unknown>	DEFAULT	2
getpagesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x80007ecc	56	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getppid	.symtab	0x80007f04	56	FUNC	<unknown>	DEFAULT	2
getppid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x80007f3c	90	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getservbyname	.symtab	0x80013c60	60	FUNC	<unknown>	DEFAULT	2
getservbyname_r	.symtab	0x80013b4c	276	FUNC	<unknown>	DEFAULT	2
getservbyport	.symtab	0x80013b10	60	FUNC	<unknown>	DEFAULT	2
getservbyport_r	.symtab	0x80013a3c	212	FUNC	<unknown>	DEFAULT	2
getservent	.symtab	0x80013910	52	FUNC	<unknown>	DEFAULT	2
getservent_r	.symtab	0x80013632	734	FUNC	<unknown>	DEFAULT	2
getservice.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x8000e984	66	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x800111f0	60	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
h_errno	.symtab	0x8002541c	4	OBJECT	<unknown>	DEFAULT	10
have_current_got	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
have_current_got	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
have_current_got	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
head	.symtab	0x80026688	4	OBJECT	<unknown>	DEFAULT	10
heap_alloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
heap_alloc_at.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
heap_free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
help	.symtab	0x80005aba	1114	FUNC	<unknown>	DEFAULT	2
histClear	.symtab	0x800060f6	38	FUNC	<unknown>	DEFAULT	2
hold	.symtab	0x80002c0c	198	FUNC	<unknown>	DEFAULT	2
host2ip	.symtab	0x80001190	150	FUNC	<unknown>	DEFAULT	2
htonl	.symtab	0x8000c0e2	12	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0x8000c0ee	22	FUNC	<unknown>	DEFAULT	2
i.5393	.symtab	0x8001f3a6	4	OBJECT	<unknown>	DEFAULT	10
i.5435	.symtab	0x8001eb00	4	OBJECT	<unknown>	DEFAULT	9
ident	.symtab	0x80025564	4	OBJECT	<unknown>	DEFAULT	10
identd	.symtab	0x80000574	614	FUNC	<unknown>	DEFAULT	2
if_freenameindex	.symtab	0x80014048	72	FUNC	<unknown>	DEFAULT	2
if_index.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
if_indextoname	.symtab	0x80013c9c	170	FUNC	<unknown>	DEFAULT	2
if_nameindex	.symtab	0x80013de0	616	FUNC	<unknown>	DEFAULT	2
if_nametoindex	.symtab	0x80013d46	154	FUNC	<unknown>	DEFAULT	2
in6_addr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
in6addr_any	.symtab	0x8001ba10	16	OBJECT	<unknown>	DEFAULT	4
in6addr_loopback	.symtab	0x8001ba20	16	OBJECT	<unknown>	DEFAULT	4
in_cksum	.symtab	0x80000824	164	FUNC	<unknown>	DEFAULT	2
index	.symtab	0x80013380	390	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x8000dfec	48	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x80014090	362	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa	.symtab	0x8000dfcc	30	FUNC	<unknown>	DEFAULT	2
inet_ntoa.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa_r	.symtab	0x8000df2c	160	FUNC	<unknown>	DEFAULT	2
inet_ntop	.symtab	0x8000deba	112	FUNC	<unknown>	DEFAULT	2
inet_ntop4	.symtab	0x8000da28	464	FUNC	<unknown>	DEFAULT	2
inet_ntop6	.symtab	0x8000dbf8	706	FUNC	<unknown>	DEFAULT	2
inet_pton	.symtab	0x8000d9c8	96	FUNC	<unknown>	DEFAULT	2
inet_pton4	.symtab	0x8000d634	282	FUNC	<unknown>	DEFAULT	2
inet_pton6	.symtab	0x8000d74e	634	FUNC	<unknown>	DEFAULT	2
infected	.symtab	0x8001eaf4	8	OBJECT	<unknown>	DEFAULT	9
init_rand	.symtab	0x80001226	144	FUNC	<unknown>	DEFAULT	2
initial_fa	.symtab	0x8001ed44	260	OBJECT	<unknown>	DEFAULT	9
initstate	.symtab	0x8000f68a	118	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x8000fb9e	330	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x80007f98	130	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isatty	.symtab	0x8000bfd4	52	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ismaster	.symtab	0x80006082	116	FUNC	<unknown>	DEFAULT	2
junk	.symtab	0x8000263a	198	FUNC	<unknown>	DEFAULT	2
key	.symtab	0x80026690	4	OBJECT	<unknown>	DEFAULT	10
kill	.symtab	0x80008064	20	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
killall	.symtab	0x80005f14	208	FUNC	<unknown>	DEFAULT	2
killd	.symtab	0x80005fe4	110	FUNC	<unknown>	DEFAULT	2
knownBots	.symtab	0x8001e228	776	OBJECT	<unknown>	DEFAULT	9
legit	.symtab	0x8001eaec	8	OBJECT	<unknown>	DEFAULT	9
lengthd.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lengthq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/m68k/crt1.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/m68k/crti.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/m68k/crtn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/m68k/vfork.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
limiter	.symtab	0x80025568	4	OBJECT	<unknown>	DEFAULT	10
listFork	.symtab	0x80001a30	188	FUNC	<unknown>	DEFAULT	2
listen	.symtab	0x8000e9c8	42	FUNC	<unknown>	DEFAULT	2
listen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x80016dda	108	FUNC	<unknown>	DEFAULT	2
main	.symtab	0x8000732a	2054	FUNC	<unknown>	DEFAULT	2
makeFukdString	.symtab	0x80007234	146	FUNC	<unknown>	DEFAULT	2
makeRandomShit	.symtab	0x800016de	136	FUNC	<unknown>	DEFAULT	2
malloc	.symtab	0x8000ecf2	168	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
masters	.symtab	0x8001e218	12	OBJECT	<unknown>	DEFAULT	9
memchr	.symtab	0x80012ab0	348	FUNC	<unknown>	DEFAULT	2
memchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memcpy	.symtab	0x8000b49e	240	FUNC	<unknown>	DEFAULT	2
memcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memmove	.symtab	0x800130cc	288	FUNC	<unknown>	DEFAULT	2
memmove.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mempcpy	.symtab	0x800131ec	42	FUNC	<unknown>	DEFAULT	2
mempcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memrchr	.symtab	0x80013218	358	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x8000b590	310	FUNC	<unknown>	DEFAULT	2
memset.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mfork	.symtab	0x80000388	238	FUNC	<unknown>	DEFAULT	2
move	.symtab	0x80005a5c	94	FUNC	<unknown>	DEFAULT	2
msgs	.symtab	0x8001ebbc	64	OBJECT	<unknown>	DEFAULT	9
mygethostbyname	.symtab	0x800008c8	176	FUNC	<unknown>	DEFAULT	2
mylock	.symtab	0x800233ac	24	OBJECT	<unknown>	DEFAULT	10
mylock	.symtab	0x8001ee48	24	OBJECT	<unknown>	DEFAULT	9
mylock	.symtab	0x8001ef28	24	OBJECT	<unknown>	DEFAULT	9
mylock	.symtab	0x8002543c	24	OBJECT	<unknown>	DEFAULT	10
mylock	.symtab	0x8001ef5c	24	OBJECT	<unknown>	DEFAULT	9
nanosleep	.symtab	0x8001122c	78	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
negotiate	.symtab	0x80003efc	298	FUNC	<unknown>	DEFAULT	2
next_start.1067	.symtab	0x800253d0	4	OBJECT	<unknown>	DEFAULT	10
nick	.symtab	0x8002556c	4	OBJECT	<unknown>	DEFAULT	10
nickc	.symtab	0x80000e80	136	FUNC	<unknown>	DEFAULT	2
ntohl	.symtab	0x8000c0c0	12	FUNC	<unknown>	DEFAULT	2
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0x8000c0cc	22	FUNC	<unknown>	DEFAULT	2
ntop.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
nummasters	.symtab	0x8001e214	4	OBJECT	<unknown>	DEFAULT	9
numpids	.symtab	0x8001efa2	4	OBJECT	<unknown>	DEFAULT	10
numservers	.symtab	0x8001e208	4	OBJECT	<unknown>	DEFAULT	9
object.2251	.symtab	0x8001ef76	24	OBJECT	<unknown>	DEFAULT	10
open	.symtab	0x800112da	80	FUNC	<unknown>	DEFAULT	2
open.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opennameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opensock.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
p.2168	.symtab	0x8001e200	0	OBJECT	<unknown>	DEFAULT	9
passwords	.symtab	0x8001e810	592	OBJECT	<unknown>	DEFAULT	9
pclose	.symtab	0x800087d0	270	FUNC	<unknown>	DEFAULT	2
perror	.symtab	0x800084b8	74	FUNC	<unknown>	DEFAULT	2
perror.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pid	.symtab	0x80025560	4	OBJECT	<unknown>	DEFAULT	10
pids	.symtab	0x8002669c	4	OBJECT	<unknown>	DEFAULT	10
pipe	.symtab	0x80011348	62	FUNC	<unknown>	DEFAULT	2
pipe.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
poll	.symtab	0x80008078	88	FUNC	<unknown>	DEFAULT	2
poll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
popen	.symtab	0x800088de	560	FUNC	<unknown>	DEFAULT	2
popen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
popen_list	.symtab	0x800233c4	4	OBJECT	<unknown>	DEFAULT	10
poww	.symtab	0x800007da	74	FUNC	<unknown>	DEFAULT	2
pps	.symtab	0x80025680	4	OBJECT	<unknown>	DEFAULT	10
prefix.4042	.symtab	0x8001adb7	12	OBJECT	<unknown>	DEFAULT	4
print	.symtab	0x800037be	688	FUNC	<unknown>	DEFAULT	2
printchar	.symtab	0x8000356c	68	FUNC	<unknown>	DEFAULT	2
printi	.symtab	0x80003686	312	FUNC	<unknown>	DEFAULT	2
prints	.symtab	0x800035b0	214	FUNC	<unknown>	DEFAULT	2
putc	.symtab	0x8000a848	284	FUNC	<unknown>	DEFAULT	2
putc_unlocked	.symtab	0x8000adf8	392	FUNC	<unknown>	DEFAULT	2
puts	.symtab	0x80008504	172	FUNC	<unknown>	DEFAULT	2
puts.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
qual_chars.4045	.symtab	0x8001adca	20	OBJECT	<unknown>	DEFAULT	4
raise	.symtab	0x80016d5c	28	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x8000f5a8	14	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_cmwc	.symtab	0x800012b6	280	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x8000f5b8	94	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x8001ba5a	40	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x8000f8ee	266	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randstring	.symtab	0x800004ce	166	FUNC	<unknown>	DEFAULT	2
randtbl	.symtab	0x8001ee7c	128	OBJECT	<unknown>	DEFAULT	9
rawmemchr	.symtab	0x80015f88	274	FUNC	<unknown>	DEFAULT	2
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0x80016e48	84	FUNC	<unknown>	DEFAULT	2
read.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read_etc_hosts_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read_until_response	.symtab	0x800041b4	136	FUNC	<unknown>	DEFAULT	2
read_with_timeout	.symtab	0x80004100	180	FUNC	<unknown>	DEFAULT	2
realloc	.symtab	0x8000ef6c	408	FUNC	<unknown>	DEFAULT	2
realloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
realrand	.symtab	0x80000f08	70	FUNC	<unknown>	DEFAULT	2
recv	.symtab	0x8000e9f4	56	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rekdevice	.symtab	0x8001e224	4	OBJECT	<unknown>	DEFAULT	9
reset_telstate	.symtab	0x800042b4	32	FUNC	<unknown>	DEFAULT	2
rewind	.symtab	0x80015a10	134	FUNC	<unknown>	DEFAULT	2
rewind.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rnd	.symtab	0x80026694	4	OBJECT	<unknown>	DEFAULT	10
rndnick	.symtab	0x80000f4e	92	FUNC	<unknown>	DEFAULT	2
rseed	.symtab	0x80025688	4096	OBJECT	<unknown>	DEFAULT	10
rsi	.symtab	0x80025578	4	OBJECT	<unknown>	DEFAULT	10
sbrk	.symtab	0x80011388	106	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
scanPid	.symtab	0x8001ef90	4	OBJECT	<unknown>	DEFAULT	10
sclose	.symtab	0x800042d4	44	FUNC	<unknown>	DEFAULT	2
select	.symtab	0x800080d0	100	FUNC	<unknown>	DEFAULT	2
select.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send	.symtab	0x8000ea2c	56	FUNC	<unknown>	DEFAULT	2
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sendHOLD	.symtab	0x80002700	1292	FUNC	<unknown>	DEFAULT	2
sendHTTP	.symtab	0x80001ec6	376	FUNC	<unknown>	DEFAULT	2
sendJUNK	.symtab	0x80002150	1258	FUNC	<unknown>	DEFAULT	2
sendSTD	.symtab	0x80001aec	736	FUNC	<unknown>	DEFAULT	2
sendto	.symtab	0x8000ea64	70	FUNC	<unknown>	DEFAULT	2
sendto.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
serv	.symtab	0x80025428	16	OBJECT	<unknown>	DEFAULT	10
serv_stayopen	.symtab	0x80025438	4	OBJECT	<unknown>	DEFAULT	10
servbuf	.symtab	0x80025420	4	OBJECT	<unknown>	DEFAULT	10
server	.symtab	0x80025684	4	OBJECT	<unknown>	DEFAULT	10
servers	.symtab	0x8001e20c	8	OBJECT	<unknown>	DEFAULT	9
servf	.symtab	0x80025424	4	OBJECT	<unknown>	DEFAULT	10
setservent	.symtab	0x800139b0	140	FUNC	<unknown>	DEFAULT	2
setsid	.symtab	0x80008134	56	FUNC	<unknown>	DEFAULT	2
setsid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsockopt	.symtab	0x8000eaac	64	FUNC	<unknown>	DEFAULT	2
setsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0x8000f616	116	FUNC	<unknown>	DEFAULT	2
setstate_r	.symtab	0x8000f758	406	FUNC	<unknown>	DEFAULT	2
sigaction	.symtab	0x800154e0	232	FUNC	<unknown>	DEFAULT	2
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
signal	.symtab	0x800155c8	238	FUNC	<unknown>	DEFAULT	2
signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask	.symtab	0x800113f4	160	FUNC	<unknown>	DEFAULT	2
sigprocmask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigsetops.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sleep	.symtab	0x8001022c	558	FUNC	<unknown>	DEFAULT	2
sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sleeptime	.symtab	0x8001eb04	4	OBJECT	<unknown>	DEFAULT	9
sock	.symtab	0x80025570	4	OBJECT	<unknown>	DEFAULT	10
socket	.symtab	0x8000eaec	50	FUNC	<unknown>	DEFAULT	2
socket.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket_connect	.symtab	0x80001e04	194	FUNC	<unknown>	DEFAULT	2
spec_and_mask.4044	.symtab	0x8001adde	16	OBJECT	<unknown>	DEFAULT	4
spec_base.4041	.symtab	0x8001adc3	7	OBJECT	<unknown>	DEFAULT	4
spec_chars.4041	.symtab	0x8001ae07	21	OBJECT	<unknown>	DEFAULT	4
spec_flags.4040	.symtab	0x8001ae1c	8	OBJECT	<unknown>	DEFAULT	4
spec_or_mask.4043	.symtab	0x8001adee	16	OBJECT	<unknown>	DEFAULT	4
spec_ranges.4042	.symtab	0x8001adfe	9	OBJECT	<unknown>	DEFAULT	4
spoofs	.symtab	0x8001ef9a	4	OBJECT	<unknown>	DEFAULT	10
spoofsm	.symtab	0x8001ef9e	4	OBJECT	<unknown>	DEFAULT	10
sprintf	.symtab	0x80008634	52	FUNC	<unknown>	DEFAULT	2
sprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
srand	.symtab	0x8000f700	88	FUNC	<unknown>	DEFAULT	2
srandom	.symtab	0x8000f700	88	FUNC	<unknown>	DEFAULT	2
srandom_r	.symtab	0x8000f9f8	422	FUNC	<unknown>	DEFAULT	2
static_id	.symtab	0x8001ef40	2	OBJECT	<unknown>	DEFAULT	9
static_ns	.symtab	0x80025454	4	OBJECT	<unknown>	DEFAULT	10
stderr	.symtab	0x8001ec0c	4	OBJECT	<unknown>	DEFAULT	9
stdin	.symtab	0x8001ec04	4	OBJECT	<unknown>	DEFAULT	9
stdout	.symtab	0x8001ec08	4	OBJECT	<unknown>	DEFAULT	9
strcasecmp	.symtab	0x8000be3c	120	FUNC	<unknown>	DEFAULT	2
strcasecmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcasestr	.symtab	0x8000beb4	170	FUNC	<unknown>	DEFAULT	2
strcasestr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchr	.symtab	0x80013380	390	FUNC	<unknown>	DEFAULT	2
strchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcmp	.symtab	0x8000b6c8	110	FUNC	<unknown>	DEFAULT	2
strcmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcoll	.symtab	0x8000b6c8	110	FUNC	<unknown>	DEFAULT	2
strcpy	.symtab	0x8000b738	92	FUNC	<unknown>	DEFAULT	2
strcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strdup	.symtab	0x8000bf60	80	FUNC	<unknown>	DEFAULT	2
strdup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strerror_r	.symtab	0x8000bd14	264	FUNC	<unknown>	DEFAULT	2
strlen	.symtab	0x8000b794	268	FUNC	<unknown>	DEFAULT	2
strlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncat	.symtab	0x8001609c	310	FUNC	<unknown>	DEFAULT	2
strncat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncmp	.symtab	0x8000b8a0	430	FUNC	<unknown>	DEFAULT	2
strncmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncpy	.symtab	0x8000ba50	320	FUNC	<unknown>	DEFAULT	2
strncpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strnlen	.symtab	0x8000bb90	350	FUNC	<unknown>	DEFAULT	2
strnlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strpbrk	.symtab	0x800135a4	86	FUNC	<unknown>	DEFAULT	2
strpbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strspn	.symtab	0x800161d4	104	FUNC	<unknown>	DEFAULT	2
strspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok	.symtab	0x8000bfb0	36	FUNC	<unknown>	DEFAULT	2
strtok.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok_r	.symtab	0x80013508	154	FUNC	<unknown>	DEFAULT	2
strtok_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtol	.symtab	0x8000fe84	34	FUNC	<unknown>	DEFAULT	2
strtol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtoul	.symtab	0x8000fea8	32	FUNC	<unknown>	DEFAULT	2
strtoul.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strwildmatch	.symtab	0x8000020c	302	FUNC	<unknown>	DEFAULT	2
successes	.symtab	0x8001eaa0	32	OBJECT	<unknown>	DEFAULT	9
sysconf	.symtab	0x8001045c	1782	FUNC	<unknown>	DEFAULT	2
sysconf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
system	.symtab	0x8000fce8	382	FUNC	<unknown>	DEFAULT	2
system.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
szprintf	.symtab	0x80003a6e	40	FUNC	<unknown>	DEFAULT	2
tcgetattr	.symtab	0x8000c008	182	FUNC	<unknown>	DEFAULT	2
tcgetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tehport	.symtab	0x8002668c	4	OBJECT	<unknown>	DEFAULT	10
textBuffer.4875	.symtab	0x8001efa6	1024	OBJECT	<unknown>	DEFAULT	10
thanks	.symtab	0x8001eb08	4	OBJECT	<unknown>	DEFAULT	9
time	.symtab	0x8000816c	62	FUNC	<unknown>	DEFAULT	2
time.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tolower	.symtab	0x8001150c	64	FUNC	<unknown>	DEFAULT	2
tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
touchMyself	.symtab	0x800072c6	100	FUNC	<unknown>	DEFAULT	2
toupper	.symtab	0x800082a0	64	FUNC	<unknown>	DEFAULT	2
toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
type_codes	.symtab	0x8001ae24	24	OBJECT	<unknown>	DEFAULT	4
type_sizes	.symtab	0x8001ae3c	12	OBJECT	<unknown>	DEFAULT	4
umask	.symtab	0x80008204	36	FUNC	<unknown>	DEFAULT	2
umask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
unknown	.symtab	0x80001766	714	FUNC	<unknown>	DEFAULT	2
unknown.1089	.symtab	0x8001ae48	14	OBJECT	<unknown>	DEFAULT	4
unsafe_state	.symtab	0x8001ee60	28	OBJECT	<unknown>	DEFAULT	9
user	.symtab	0x8002557c	4	OBJECT	<unknown>	DEFAULT	10
usernames	.symtab	0x8001e5c0	592	OBJECT	<unknown>	DEFAULT	9
usleep	.symtab	0x80010b54	142	FUNC	<unknown>	DEFAULT	2
usleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
vasprintf	.symtab	0x80008668	158	FUNC	<unknown>	DEFAULT	2
vasprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
version	.symtab	0x80000e60	32	FUNC	<unknown>	DEFAULT	2
vfork	.symtab	0x80010f94	38	FUNC	<unknown>	DEFAULT	2
vfprintf	.symtab	0x800090c4	182	FUNC	<unknown>	DEFAULT	2
vfprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
vsnprintf	.symtab	0x80008708	198	FUNC	<unknown>	DEFAULT	2
vsnprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
vsprintf	.symtab	0x800085b0	34	FUNC	<unknown>	DEFAULT	2
vsprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wait4	.symtab	0x800114ee	30	FUNC	<unknown>	DEFAULT	2
wait4.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
waitpid	.symtab	0x80008228	34	FUNC	<unknown>	DEFAULT	2
waitpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcrtomb	.symtab	0x8001155c	100	FUNC	<unknown>	DEFAULT	2
wcrtomb.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsnrtombs	.symtab	0x800115e8	206	FUNC	<unknown>	DEFAULT	2
wcsnrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsrtombs	.symtab	0x800115c0	38	FUNC	<unknown>	DEFAULT	2
wcsrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
write	.symtab	0x8000824c	84	FUNC	<unknown>	DEFAULT	2
write.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
xdigits.3095	.symtab	0x8001b9ff	17	OBJECT	<unknown>	DEFAULT	4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 23, 2024 11:03:00.136883974 CET	38752	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:03:00.257963896 CET	6780	38752	95.234.158.87	192.168.2.23
Nov 23, 2024 11:03:00.258054018 CET	38752	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:03:01.162255049 CET	38752	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:03:01.281804085 CET	6780	38752	95.234.158.87	192.168.2.23
Nov 23, 2024 11:03:01.502800941 CET	6780	38752	95.234.158.87	192.168.2.23
Nov 23, 2024 11:03:01.502857924 CET	38752	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:03:01.615427971 CET	6780	38752	95.234.158.87	192.168.2.23
Nov 23, 2024 11:03:01.615438938 CET	6780	38752	95.234.158.87	192.168.2.23
Nov 23, 2024 11:03:01.615499973 CET	38752	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:03:01.616348028 CET	38752	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:03:01.738265991 CET	6780	38752	95.234.158.87	192.168.2.23
Nov 23, 2024 11:03:03.196382046 CET	42836	443	192.168.2.23	91.189.91.43
Nov 23, 2024 11:03:03.964272976 CET	42516	80	192.168.2.23	109.202.202.202
Nov 23, 2024 11:03:06.618905067 CET	38754	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:03:06.836096048 CET	6780	38754	95.234.158.87	192.168.2.23
Nov 23, 2024 11:03:06.836169004 CET	38754	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:03:07.623614073 CET	38754	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:03:07.743222952 CET	6780	38754	95.234.158.87	192.168.2.23
Nov 23, 2024 11:03:08.809824944 CET	6780	38754	95.234.158.87	192.168.2.23
Nov 23, 2024 11:03:08.809843063 CET	6780	38754	95.234.158.87	192.168.2.23
Nov 23, 2024 11:03:08.809899092 CET	38754	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:03:08.810173035 CET	38754	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:03:08.929591894 CET	6780	38754	95.234.158.87	192.168.2.23
Nov 23, 2024 11:03:13.813189983 CET	38756	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:03:13.932776928 CET	6780	38756	95.234.158.87	192.168.2.23
Nov 23, 2024 11:03:13.932837009 CET	38756	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:03:14.819277048 CET	38756	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:03:14.939960003 CET	6780	38756	95.234.158.87	192.168.2.23
Nov 23, 2024 11:03:15.101705074 CET	6780	38756	95.234.158.87	192.168.2.23
Nov 23, 2024 11:03:15.101847887 CET	6780	38756	95.234.158.87	192.168.2.23
Nov 23, 2024 11:03:15.101896048 CET	38756	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:03:15.102056026 CET	38756	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:03:15.302536011 CET	6780	38756	95.234.158.87	192.168.2.23
Nov 23, 2024 11:03:19.322343111 CET	43928	443	192.168.2.23	91.189.91.42
Nov 23, 2024 11:03:20.163278103 CET	38758	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:03:20.284507036 CET	6780	38758	95.234.158.87	192.168.2.23
Nov 23, 2024 11:03:20.284569979 CET	38758	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:03:21.167785883 CET	38758	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:03:21.287552118 CET	6780	38758	95.234.158.87	192.168.2.23
Nov 23, 2024 11:03:21.452548981 CET	6780	38758	95.234.158.87	192.168.2.23
Nov 23, 2024 11:03:21.452616930 CET	38758	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:03:21.452660084 CET	6780	38758	95.234.158.87	192.168.2.23
Nov 23, 2024 11:03:21.452709913 CET	38758	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:03:21.452783108 CET	38758	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:03:21.572196007 CET	6780	38758	95.234.158.87	192.168.2.23
Nov 23, 2024 11:03:26.453845024 CET	38760	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:03:26.573431015 CET	6780	38760	95.234.158.87	192.168.2.23
Nov 23, 2024 11:03:26.573487997 CET	38760	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:03:27.457587004 CET	38760	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:03:27.577255011 CET	6780	38760	95.234.158.87	192.168.2.23
Nov 23, 2024 11:03:27.720495939 CET	6780	38760	95.234.158.87	192.168.2.23
Nov 23, 2024 11:03:27.720520020 CET	6780	38760	95.234.158.87	192.168.2.23
Nov 23, 2024 11:03:27.720558882 CET	38760	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:03:27.720643044 CET	38760	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:03:27.840130091 CET	6780	38760	95.234.158.87	192.168.2.23
Nov 23, 2024 11:03:29.560834885 CET	42836	443	192.168.2.23	91.189.91.43
Nov 23, 2024 11:03:32.722251892 CET	38762	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:03:32.842103958 CET	6780	38762	95.234.158.87	192.168.2.23
Nov 23, 2024 11:03:32.842185020 CET	38762	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:03:33.656272888 CET	42516	80	192.168.2.23	109.202.202.202
Nov 23, 2024 11:03:33.727193117 CET	38762	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:03:33.850127935 CET	6780	38762	95.234.158.87	192.168.2.23
Nov 23, 2024 11:03:33.957990885 CET	6780	38762	95.234.158.87	192.168.2.23
Nov 23, 2024 11:03:33.958101034 CET	6780	38762	95.234.158.87	192.168.2.23
Nov 23, 2024 11:03:33.958239079 CET	38762	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:03:33.958312988 CET	38762	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:03:34.082804918 CET	6780	38762	95.234.158.87	192.168.2.23
Nov 23, 2024 11:03:38.959429979 CET	38764	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:03:39.079672098 CET	6780	38764	95.234.158.87	192.168.2.23
Nov 23, 2024 11:03:39.079751968 CET	38764	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:03:39.962402105 CET	38764	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:03:40.082027912 CET	6780	38764	95.234.158.87	192.168.2.23
Nov 23, 2024 11:03:40.228154898 CET	6780	38764	95.234.158.87	192.168.2.23
Nov 23, 2024 11:03:40.228282928 CET	6780	38764	95.234.158.87	192.168.2.23
Nov 23, 2024 11:03:40.228429079 CET	38764	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:03:40.228429079 CET	38764	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:03:40.228554010 CET	38764	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:03:40.348090887 CET	6780	38764	95.234.158.87	192.168.2.23
Nov 23, 2024 11:03:45.230432987 CET	38766	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:03:45.350263119 CET	6780	38766	95.234.158.87	192.168.2.23
Nov 23, 2024 11:03:45.350333929 CET	38766	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:03:46.235461950 CET	38766	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:03:46.355082989 CET	6780	38766	95.234.158.87	192.168.2.23
Nov 23, 2024 11:03:46.535319090 CET	6780	38766	95.234.158.87	192.168.2.23
Nov 23, 2024 11:03:46.535499096 CET	38766	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:03:46.535510063 CET	6780	38766	95.234.158.87	192.168.2.23
Nov 23, 2024 11:03:46.535640955 CET	38766	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:03:46.535811901 CET	38766	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:03:46.655356884 CET	6780	38766	95.234.158.87	192.168.2.23
Nov 23, 2024 11:03:51.536807060 CET	38768	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:03:51.674016953 CET	6780	38768	95.234.158.87	192.168.2.23
Nov 23, 2024 11:03:51.674102068 CET	38768	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:03:52.540987968 CET	38768	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:03:52.660846949 CET	6780	38768	95.234.158.87	192.168.2.23
Nov 23, 2024 11:03:53.659260988 CET	6780	38768	95.234.158.87	192.168.2.23
Nov 23, 2024 11:03:53.659369946 CET	6780	38768	95.234.158.87	192.168.2.23
Nov 23, 2024 11:03:53.659635067 CET	38768	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:03:53.659635067 CET	38768	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:03:53.779175997 CET	6780	38768	95.234.158.87	192.168.2.23
Nov 23, 2024 11:03:58.660794020 CET	38770	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:03:58.781394958 CET	6780	38770	95.234.158.87	192.168.2.23
Nov 23, 2024 11:03:58.781486034 CET	38770	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:03:59.664997101 CET	38770	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:03:59.784610033 CET	6780	38770	95.234.158.87	192.168.2.23
Nov 23, 2024 11:03:59.979342937 CET	6780	38770	95.234.158.87	192.168.2.23
Nov 23, 2024 11:03:59.979399920 CET	38770	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:03:59.979440928 CET	6780	38770	95.234.158.87	192.168.2.23
Nov 23, 2024 11:03:59.979499102 CET	38770	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:03:59.979499102 CET	38770	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:04:00.099344969 CET	6780	38770	95.234.158.87	192.168.2.23
Nov 23, 2024 11:04:00.276470900 CET	43928	443	192.168.2.23	91.189.91.42
Nov 23, 2024 11:04:05.030627966 CET	38772	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:04:05.150358915 CET	6780	38772	95.234.158.87	192.168.2.23
Nov 23, 2024 11:04:05.150621891 CET	38772	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:04:06.080252886 CET	38772	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:04:06.200576067 CET	6780	38772	95.234.158.87	192.168.2.23
Nov 23, 2024 11:04:06.376904964 CET	6780	38772	95.234.158.87	192.168.2.23
Nov 23, 2024 11:04:06.376967907 CET	38772	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:04:06.377095938 CET	38772	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:04:06.377156019 CET	6780	38772	95.234.158.87	192.168.2.23
Nov 23, 2024 11:04:06.377247095 CET	38772	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:04:06.631787062 CET	6780	38772	95.234.158.87	192.168.2.23
Nov 23, 2024 11:04:11.378216982 CET	38774	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:04:11.497941971 CET	6780	38774	95.234.158.87	192.168.2.23
Nov 23, 2024 11:04:11.498131037 CET	38774	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:04:12.382350922 CET	38774	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:04:12.503032923 CET	6780	38774	95.234.158.87	192.168.2.23
Nov 23, 2024 11:04:12.781989098 CET	6780	38774	95.234.158.87	192.168.2.23
Nov 23, 2024 11:04:12.782084942 CET	38774	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:04:12.891855955 CET	6780	38774	95.234.158.87	192.168.2.23
Nov 23, 2024 11:04:12.891956091 CET	38774	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:04:12.891985893 CET	6780	38774	95.234.158.87	192.168.2.23
Nov 23, 2024 11:04:12.892169952 CET	38774	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:04:13.011939049 CET	6780	38774	95.234.158.87	192.168.2.23
Nov 23, 2024 11:04:17.893192053 CET	38776	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:04:18.013725042 CET	6780	38776	95.234.158.87	192.168.2.23
Nov 23, 2024 11:04:18.013801098 CET	38776	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:04:18.896732092 CET	38776	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:04:19.017813921 CET	6780	38776	95.234.158.87	192.168.2.23
Nov 23, 2024 11:04:19.215672016 CET	6780	38776	95.234.158.87	192.168.2.23
Nov 23, 2024 11:04:19.215825081 CET	6780	38776	95.234.158.87	192.168.2.23
Nov 23, 2024 11:04:19.215857029 CET	38776	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:04:19.215986967 CET	38776	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:04:19.336375952 CET	6780	38776	95.234.158.87	192.168.2.23
Nov 23, 2024 11:04:24.217398882 CET	38778	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:04:24.337084055 CET	6780	38778	95.234.158.87	192.168.2.23
Nov 23, 2024 11:04:24.337167978 CET	38778	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:04:25.221645117 CET	38778	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:04:25.376725912 CET	6780	38778	95.234.158.87	192.168.2.23
Nov 23, 2024 11:04:25.492535114 CET	6780	38778	95.234.158.87	192.168.2.23
Nov 23, 2024 11:04:25.492619991 CET	38778	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:04:25.492701054 CET	38778	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:04:25.492737055 CET	6780	38778	95.234.158.87	192.168.2.23
Nov 23, 2024 11:04:25.492780924 CET	38778	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:04:25.612164021 CET	6780	38778	95.234.158.87	192.168.2.23
Nov 23, 2024 11:04:30.493671894 CET	38780	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:04:30.615554094 CET	6780	38780	95.234.158.87	192.168.2.23
Nov 23, 2024 11:04:30.615777969 CET	38780	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:04:31.499294043 CET	38780	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:04:31.618880033 CET	6780	38780	95.234.158.87	192.168.2.23
Nov 23, 2024 11:04:31.805951118 CET	6780	38780	95.234.158.87	192.168.2.23
Nov 23, 2024 11:04:31.805977106 CET	6780	38780	95.234.158.87	192.168.2.23
Nov 23, 2024 11:04:31.806246042 CET	38780	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:04:31.806246042 CET	38780	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:04:31.926064014 CET	6780	38780	95.234.158.87	192.168.2.23
Nov 23, 2024 11:04:36.808161020 CET	38782	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:04:36.927850008 CET	6780	38782	95.234.158.87	192.168.2.23
Nov 23, 2024 11:04:36.927942038 CET	38782	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:04:37.813134909 CET	38782	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:04:37.932682991 CET	6780	38782	95.234.158.87	192.168.2.23
Nov 23, 2024 11:04:38.105577946 CET	6780	38782	95.234.158.87	192.168.2.23
Nov 23, 2024 11:04:38.105616093 CET	6780	38782	95.234.158.87	192.168.2.23
Nov 23, 2024 11:04:38.105637074 CET	38782	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:04:38.105730057 CET	38782	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:04:38.232409954 CET	6780	38782	95.234.158.87	192.168.2.23
Nov 23, 2024 11:04:43.107625961 CET	38784	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:04:43.241096020 CET	6780	38784	95.234.158.87	192.168.2.23
Nov 23, 2024 11:04:43.241278887 CET	38784	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:04:43.488662004 CET	6780	38784	95.234.158.87	192.168.2.23
Nov 23, 2024 11:04:43.490483999 CET	38784	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:04:44.112195015 CET	38784	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:04:44.175880909 CET	38784	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:04:44.223813057 CET	38784	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:04:44.231748104 CET	6780	38784	95.234.158.87	192.168.2.23
Nov 23, 2024 11:04:44.233377934 CET	38786	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:04:44.296319008 CET	6780	38784	95.234.158.87	192.168.2.23
Nov 23, 2024 11:04:44.343873024 CET	6780	38784	95.234.158.87	192.168.2.23
Nov 23, 2024 11:04:44.353070021 CET	6780	38786	95.234.158.87	192.168.2.23
Nov 23, 2024 11:04:44.353127956 CET	38786	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:04:45.238383055 CET	38786	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:04:45.358067989 CET	6780	38786	95.234.158.87	192.168.2.23
Nov 23, 2024 11:04:45.552862883 CET	6780	38786	95.234.158.87	192.168.2.23
Nov 23, 2024 11:04:45.552993059 CET	6780	38786	95.234.158.87	192.168.2.23
Nov 23, 2024 11:04:45.553008080 CET	38786	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:04:45.553148031 CET	38786	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:04:45.676346064 CET	6780	38786	95.234.158.87	192.168.2.23
Nov 23, 2024 11:04:50.554362059 CET	38788	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:04:50.674782991 CET	6780	38788	95.234.158.87	192.168.2.23
Nov 23, 2024 11:04:50.674894094 CET	38788	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:04:51.558655024 CET	38788	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:04:51.765506983 CET	6780	38788	95.234.158.87	192.168.2.23
Nov 23, 2024 11:04:51.815115929 CET	6780	38788	95.234.158.87	192.168.2.23
Nov 23, 2024 11:04:51.815295935 CET	6780	38788	95.234.158.87	192.168.2.23
Nov 23, 2024 11:04:51.815330982 CET	38788	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:04:51.815330982 CET	38788	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:04:51.815371990 CET	38788	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:04:51.935062885 CET	6780	38788	95.234.158.87	192.168.2.23
Nov 23, 2024 11:04:56.816126108 CET	38790	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:04:56.935866117 CET	6780	38790	95.234.158.87	192.168.2.23
Nov 23, 2024 11:04:56.936007023 CET	38790	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:04:57.820785046 CET	38790	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:04:57.940377951 CET	6780	38790	95.234.158.87	192.168.2.23
Nov 23, 2024 11:04:58.082703114 CET	6780	38790	95.234.158.87	192.168.2.23
Nov 23, 2024 11:04:58.082786083 CET	38790	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:04:58.082854986 CET	38790	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:04:58.082871914 CET	6780	38790	95.234.158.87	192.168.2.23
Nov 23, 2024 11:04:58.082938910 CET	38790	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:04:58.204343081 CET	6780	38790	95.234.158.87	192.168.2.23
Nov 23, 2024 11:05:03.084055901 CET	38792	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:05:03.203682899 CET	6780	38792	95.234.158.87	192.168.2.23
Nov 23, 2024 11:05:03.203764915 CET	38792	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:05:04.088161945 CET	38792	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:05:04.208204985 CET	6780	38792	95.234.158.87	192.168.2.23
Nov 23, 2024 11:05:04.362395048 CET	6780	38792	95.234.158.87	192.168.2.23
Nov 23, 2024 11:05:04.362519026 CET	6780	38792	95.234.158.87	192.168.2.23
Nov 23, 2024 11:05:04.362728119 CET	38792	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:05:04.362775087 CET	38792	6780	192.168.2.23	95.234.158.87
Nov 23, 2024 11:05:04.482464075 CET	6780	38792	95.234.158.87	192.168.2.23

IRC Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Nov 23, 2024 11:03:01.162255049 CET	38752	6780	192.168.2.23	95.234.158.87	NICK [OSX\|M68K]PaIepvQ USER PaIepvQ localhost localhost :PaIepvQ
Nov 23, 2024 11:03:07.623614073 CET	38754	6780	192.168.2.23	95.234.158.87	NICK [OSX\|M68K]PaIepvQ USER PaIepvQ localhost localhost :PaIepvQ
Nov 23, 2024 11:03:14.819277048 CET	38756	6780	192.168.2.23	95.234.158.87	NICK [OSX\|M68K]PaIepvQ USER PaIepvQ localhost localhost :PaIepvQ
Nov 23, 2024 11:03:21.167785883 CET	38758	6780	192.168.2.23	95.234.158.87	NICK [OSX\|M68K]PaIepvQ USER PaIepvQ localhost localhost :PaIepvQ
Nov 23, 2024 11:03:27.457587004 CET	38760	6780	192.168.2.23	95.234.158.87	NICK [OSX\|M68K]PaIepvQ USER PaIepvQ localhost localhost :PaIepvQ
Nov 23, 2024 11:03:33.727193117 CET	38762	6780	192.168.2.23	95.234.158.87	NICK [OSX\|M68K]PaIepvQ USER PaIepvQ localhost localhost :PaIepvQ
Nov 23, 2024 11:03:39.962402105 CET	38764	6780	192.168.2.23	95.234.158.87	NICK [OSX\|M68K]PaIepvQ USER PaIepvQ localhost localhost :PaIepvQ
Nov 23, 2024 11:03:46.235461950 CET	38766	6780	192.168.2.23	95.234.158.87	NICK [OSX\|M68K]PaIepvQ USER PaIepvQ localhost localhost :PaIepvQ
Nov 23, 2024 11:03:52.540987968 CET	38768	6780	192.168.2.23	95.234.158.87	NICK [OSX\|M68K]PaIepvQ USER PaIepvQ localhost localhost :PaIepvQ
Nov 23, 2024 11:03:59.664997101 CET	38770	6780	192.168.2.23	95.234.158.87	NICK [OSX\|M68K]PaIepvQ USER PaIepvQ localhost localhost :PaIepvQ
Nov 23, 2024 11:04:06.080252886 CET	38772	6780	192.168.2.23	95.234.158.87	NICK [OSX\|M68K]PaIepvQ USER PaIepvQ localhost localhost :PaIepvQ
Nov 23, 2024 11:04:12.382350922 CET	38774	6780	192.168.2.23	95.234.158.87	NICK [OSX\|M68K]PaIepvQ USER PaIepvQ localhost localhost :PaIepvQ
Nov 23, 2024 11:04:18.896732092 CET	38776	6780	192.168.2.23	95.234.158.87	NICK [OSX\|M68K]PaIepvQ USER PaIepvQ localhost localhost :PaIepvQ
Nov 23, 2024 11:04:25.221645117 CET	38778	6780	192.168.2.23	95.234.158.87	NICK [OSX\|M68K]PaIepvQ USER PaIepvQ localhost localhost :PaIepvQ
Nov 23, 2024 11:04:31.499294043 CET	38780	6780	192.168.2.23	95.234.158.87	NICK [OSX\|M68K]PaIepvQ USER PaIepvQ localhost localhost :PaIepvQ
Nov 23, 2024 11:04:37.813134909 CET	38782	6780	192.168.2.23	95.234.158.87	NICK [OSX\|M68K]PaIepvQ USER PaIepvQ localhost localhost :PaIepvQ
Nov 23, 2024 11:04:44.112195015 CET	38784	6780	192.168.2.23	95.234.158.87	NICK [OSX\|M68K]PaIepvQ USER PaIepvQ localhost localhost :PaIepvQ
Nov 23, 2024 11:04:44.175880909 CET	38784	6780	192.168.2.23	95.234.158.87	NICK [OSX\|M68K]PaIepvQ USER PaIepvQ localhost localhost :PaIepvQ NICK [OSX\|M68K]PaIepvQ USER PaIepvQ localhost localhost :PaIepvQ NICK [OSX\|M68K]PaIepvQ USER PaIepvQ localhost localhost :PaIepvQ NICK [OSX\|M68K]PaIepvQ USER PaIepvQ localhost localhost :PaIepvQ NICK [OSX\|M68K]PaIepvQ USER PaIepvQ localhost localhost :PaIepvQ NICK [OSX\|M68K]PaIepvQ USER PaIepvQ localhost localhost :PaIepvQ NICK [OSX\|M68K]PaIepvQ USER PaIepvQ localhost localhost :PaIepvQ NICK [OSX\|M68K]PaIepvQ USER PaIepvQ localhost localhost :PaIepvQ NICK [OSX\|M68K]PaIepvQ USER PaIepvQ localhost localhost :PaIepvQ NICK [OSX\|M68K]PaIepvQ USER PaIepvQ localhost localhost :PaIepvQ NICK [OSX\|M68K]PaIepvQ USER PaIepvQ localhost localhost :PaIepvQ NICK [OSX\|M68K]PaIepvQ USER PaIepvQ localhost localhost :PaIepvQ NICK [OSX\|M68K]PaIepvQ USER PaIepvQ localhost localhost :PaIepvQ NICK [OSX\|M68K]PaIepvQ USER PaIepvQ localhost localhost :PaIepvQ NICK [OSX\|M68K]PaIepvQ USER PaIepvQ localhost localhost :PaIepvQ NICK [OSX\|M68K]PaIepvQ USER PaIepvQ localhost localhost :PaIepvQ NICK [OSX\|M68K]PaIepvQ USER PaIepvQ localhost localhost :PaIepvQ
Nov 23, 2024 11:04:44.223813057 CET	38784	6780	192.168.2.23	95.234.158.87	NICK [OSX\|M68K]PaIepvQ USER PaIepvQ localhost localhost :PaIepvQ NICK [OSX\|M68K]PaIepvQ USER PaIepvQ localhost localhost :PaIepvQ NICK [OSX\|M68K]PaIepvQ USER PaIepvQ localhost localhost :PaIepvQ NICK [OSX\|M68K]PaIepvQ USER PaIepvQ localhost localhost :PaIepvQ NICK [OSX\|M68K]PaIepvQ USER PaIepvQ localhost localhost :PaIepvQ NICK [OSX\|M68K]PaIepvQ USER PaIepvQ localhost localhost :PaIepvQ NICK [OSX\|M68K]PaIepvQ USER PaIepvQ localhost localhost :PaIepvQ NICK [OSX\|M68K]PaIepvQ USER PaIepvQ localhost localhost :PaIepvQ NICK [OSX\|M68K]PaIepvQ USER PaIepvQ localhost localhost :PaIepvQ NICK [OSX\|M68K]PaIepvQ USER PaIepvQ localhost localhost :PaIepvQ NICK [OSX\|M68K]PaIepvQ USER PaIepvQ localhost localhost :PaIepvQ NICK [OSX\|M68K]PaIepvQ USER PaIepvQ localhost localhost :PaIepvQ NICK [OSX\|M68K]PaIepvQ USER PaIepvQ localhost localhost :PaIepvQ NICK [OSX\|M68K]PaIepvQ USER PaIepvQ localhost localhost :PaIepvQ NICK [OSX\|M68K]PaIepvQ USER PaIepvQ localhost localhost :PaIepvQ NICK [OSX\|M68K]PaIepvQ USER PaIepvQ localhost localhost :PaIepvQ NICK [OSX\|M68K]PaIepvQ USER PaIepvQ localhost localhost :PaIepvQ
Nov 23, 2024 11:04:45.238383055 CET	38786	6780	192.168.2.23	95.234.158.87	NICK [OSX\|M68K]PaIepvQ USER PaIepvQ localhost localhost :PaIepvQ
Nov 23, 2024 11:04:51.558655024 CET	38788	6780	192.168.2.23	95.234.158.87	NICK [OSX\|M68K]PaIepvQ USER PaIepvQ localhost localhost :PaIepvQ
Nov 23, 2024 11:04:57.820785046 CET	38790	6780	192.168.2.23	95.234.158.87	NICK [OSX\|M68K]PaIepvQ USER PaIepvQ localhost localhost :PaIepvQ
Nov 23, 2024 11:05:04.088161945 CET	38792	6780	192.168.2.23	95.234.158.87	NICK [OSX\|M68K]PaIepvQ USER PaIepvQ localhost localhost :PaIepvQ

System Behavior

Analysis Process: yakuza.m68k.elf PID: 6261, Parent PID: 6184

General

Start time (UTC):	10:02:59
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	/tmp/yakuza.m68k.elf
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: yakuza.m68k.elf PID: 6263, Parent PID: 6261

General

Start time (UTC):	10:02:59
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: yakuza.m68k.elf PID: 6269, Parent PID: 6263

General

Start time (UTC):	10:02:59
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: yakuza.m68k.elf PID: 6270, Parent PID: 6263

General

Start time (UTC):	10:02:59
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: yakuza.m68k.elf PID: 6272, Parent PID: 6263

General

Start time (UTC):	10:02:59
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: sh PID: 6272, Parent PID: 6263

General

Start time (UTC):	10:02:59
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 902i13 \|\| busybox pkill -9 902i13"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6275, Parent PID: 6272

General

Start time (UTC):	10:02:59
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 6275, Parent PID: 6272

General

Start time (UTC):	10:02:59
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 902i13
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 6276, Parent PID: 6272

General

Start time (UTC):	10:03:01
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 6276, Parent PID: 6272

General

Start time (UTC):	10:03:01
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 902i13
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.m68k.elf PID: 6279, Parent PID: 6263

General

Start time (UTC):	10:03:02
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: sh PID: 6279, Parent PID: 6263

General

Start time (UTC):	10:03:02
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 BzSxLxBxeY \|\| busybox pkill -9 BzSxLxBxeY"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6284, Parent PID: 6279

General

Start time (UTC):	10:03:02
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 6284, Parent PID: 6279

General

Start time (UTC):	10:03:02
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 BzSxLxBxeY
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 6285, Parent PID: 6279

General

Start time (UTC):	10:03:03
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 6285, Parent PID: 6279

General

Start time (UTC):	10:03:03
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 BzSxLxBxeY
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.m68k.elf PID: 6287, Parent PID: 6263

General

Start time (UTC):	10:03:04
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: sh PID: 6287, Parent PID: 6263

General

Start time (UTC):	10:03:04
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 HOHO-LUGO7 \|\| busybox pkill -9 HOHO-LUGO7"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6289, Parent PID: 6287

General

Start time (UTC):	10:03:04
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 6289, Parent PID: 6287

General

Start time (UTC):	10:03:04
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 HOHO-LUGO7
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 6292, Parent PID: 6287

General

Start time (UTC):	10:03:06
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 6292, Parent PID: 6287

General

Start time (UTC):	10:03:06
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 HOHO-LUGO7
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.m68k.elf PID: 6293, Parent PID: 6263

General

Start time (UTC):	10:03:07
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: sh PID: 6293, Parent PID: 6263

General

Start time (UTC):	10:03:07
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 HOHO-U79OL \|\| busybox pkill -9 HOHO-U79OL"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6295, Parent PID: 6293

General

Start time (UTC):	10:03:07
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 6295, Parent PID: 6293

General

Start time (UTC):	10:03:07
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 HOHO-U79OL
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 6296, Parent PID: 6293

General

Start time (UTC):	10:03:08
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 6296, Parent PID: 6293

General

Start time (UTC):	10:03:08
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 HOHO-U79OL
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.m68k.elf PID: 6297, Parent PID: 6263

General

Start time (UTC):	10:03:09
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: sh PID: 6297, Parent PID: 6263

General

Start time (UTC):	10:03:09
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 JuYfouyf87 \|\| busybox pkill -9 JuYfouyf87"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6299, Parent PID: 6297

General

Start time (UTC):	10:03:09
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 6299, Parent PID: 6297

General

Start time (UTC):	10:03:09
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 JuYfouyf87
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 6300, Parent PID: 6297

General

Start time (UTC):	10:03:10
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 6300, Parent PID: 6297

General

Start time (UTC):	10:03:10
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 JuYfouyf87
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.m68k.elf PID: 6303, Parent PID: 6263

General

Start time (UTC):	10:03:12
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: sh PID: 6303, Parent PID: 6263

General

Start time (UTC):	10:03:12
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 NiGGeR69xd \|\| busybox pkill -9 NiGGeR69xd"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6305, Parent PID: 6303

General

Start time (UTC):	10:03:12
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 6305, Parent PID: 6303

General

Start time (UTC):	10:03:12
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 NiGGeR69xd
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 6306, Parent PID: 6303

General

Start time (UTC):	10:03:13
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 6306, Parent PID: 6303

General

Start time (UTC):	10:03:13
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 NiGGeR69xd
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.m68k.elf PID: 6307, Parent PID: 6263

General

Start time (UTC):	10:03:14
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: sh PID: 6307, Parent PID: 6263

General

Start time (UTC):	10:03:14
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 SO190Ij1X \|\| busybox pkill -9 SO190Ij1X"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6309, Parent PID: 6307

General

Start time (UTC):	10:03:14
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 6309, Parent PID: 6307

General

Start time (UTC):	10:03:14
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 SO190Ij1X
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 6310, Parent PID: 6307

General

Start time (UTC):	10:03:15
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 6310, Parent PID: 6307

General

Start time (UTC):	10:03:15
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 SO190Ij1X
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.m68k.elf PID: 6313, Parent PID: 6263

General

Start time (UTC):	10:03:16
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: sh PID: 6313, Parent PID: 6263

General

Start time (UTC):	10:03:16
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 LOLKIKEEEDDE \|\| busybox pkill -9 LOLKIKEEEDDE"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6319, Parent PID: 6313

General

Start time (UTC):	10:03:16
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 6319, Parent PID: 6313

General

Start time (UTC):	10:03:16
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 LOLKIKEEEDDE
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 6320, Parent PID: 6313

General

Start time (UTC):	10:03:18
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 6320, Parent PID: 6313

General

Start time (UTC):	10:03:18
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 LOLKIKEEEDDE
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.m68k.elf PID: 6343, Parent PID: 6263

General

Start time (UTC):	10:03:19
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: sh PID: 6343, Parent PID: 6263

General

Start time (UTC):	10:03:19
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 ekjheory98e \|\| busybox pkill -9 ekjheory98e"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6348, Parent PID: 6343

General

Start time (UTC):	10:03:19
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 6348, Parent PID: 6343

General

Start time (UTC):	10:03:19
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 ekjheory98e
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 6349, Parent PID: 6343

General

Start time (UTC):	10:03:20
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 6349, Parent PID: 6343

General

Start time (UTC):	10:03:20
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 ekjheory98e
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.m68k.elf PID: 6352, Parent PID: 6263

General

Start time (UTC):	10:03:21
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: sh PID: 6352, Parent PID: 6263

General

Start time (UTC):	10:03:21
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 scansh4 \|\| busybox pkill -9 scansh4"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6354, Parent PID: 6352

General

Start time (UTC):	10:03:21
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 6354, Parent PID: 6352

General

Start time (UTC):	10:03:21
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 scansh4
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 6355, Parent PID: 6352

General

Start time (UTC):	10:03:23
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 6355, Parent PID: 6352

General

Start time (UTC):	10:03:23
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 scansh4
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.m68k.elf PID: 6356, Parent PID: 6263

General

Start time (UTC):	10:03:24
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: sh PID: 6356, Parent PID: 6263

General

Start time (UTC):	10:03:24
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 MDMA \|\| busybox pkill -9 MDMA"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6362, Parent PID: 6356

General

Start time (UTC):	10:03:24
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 6362, Parent PID: 6356

General

Start time (UTC):	10:03:24
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 MDMA
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 6363, Parent PID: 6356

General

Start time (UTC):	10:03:25
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 6363, Parent PID: 6356

General

Start time (UTC):	10:03:25
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 MDMA
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.m68k.elf PID: 6366, Parent PID: 6263

General

Start time (UTC):	10:03:26
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: sh PID: 6366, Parent PID: 6263

General

Start time (UTC):	10:03:26
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 fdevalvex \|\| busybox pkill -9 fdevalvex"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6368, Parent PID: 6366

General

Start time (UTC):	10:03:26
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 6368, Parent PID: 6366

General

Start time (UTC):	10:03:26
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 fdevalvex
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 6369, Parent PID: 6366

General

Start time (UTC):	10:03:28
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 6369, Parent PID: 6366

General

Start time (UTC):	10:03:28
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 fdevalvex
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.m68k.elf PID: 6370, Parent PID: 6263

General

Start time (UTC):	10:03:29
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: sh PID: 6370, Parent PID: 6263

General

Start time (UTC):	10:03:29
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 scanspc \|\| busybox pkill -9 scanspc"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6375, Parent PID: 6370

General

Start time (UTC):	10:03:29
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 6375, Parent PID: 6370

General

Start time (UTC):	10:03:29
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 scanspc
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 6376, Parent PID: 6370

General

Start time (UTC):	10:03:30
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 6376, Parent PID: 6370

General

Start time (UTC):	10:03:30
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 scanspc
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.m68k.elf PID: 6379, Parent PID: 6263

General

Start time (UTC):	10:03:31
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: sh PID: 6379, Parent PID: 6263

General

Start time (UTC):	10:03:31
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 MELTEDNINJAREALZ \|\| busybox pkill -9 MELTEDNINJAREALZ"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6381, Parent PID: 6379

General

Start time (UTC):	10:03:31
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 6381, Parent PID: 6379

General

Start time (UTC):	10:03:31
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 MELTEDNINJAREALZ
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 6382, Parent PID: 6379

General

Start time (UTC):	10:03:32
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 6382, Parent PID: 6379

General

Start time (UTC):	10:03:32
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 MELTEDNINJAREALZ
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.m68k.elf PID: 6383, Parent PID: 6263

General

Start time (UTC):	10:03:33
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: sh PID: 6383, Parent PID: 6263

General

Start time (UTC):	10:03:33
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 flexsonskids \|\| busybox pkill -9 flexsonskids"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6385, Parent PID: 6383

General

Start time (UTC):	10:03:33
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 6385, Parent PID: 6383

General

Start time (UTC):	10:03:33
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 flexsonskids
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 6387, Parent PID: 6383

General

Start time (UTC):	10:03:34
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 6387, Parent PID: 6383

General

Start time (UTC):	10:03:34
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 flexsonskids
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.m68k.elf PID: 6388, Parent PID: 6263

General

Start time (UTC):	10:03:35
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Chronological Activities

Analysis Process: sh PID: 6388, Parent PID: 6263

General

Start time (UTC):	10:03:35
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 scanx86 \|\| busybox pkill -9 scanx86"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6394, Parent PID: 6388

General

Start time (UTC):	10:03:35
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 6394, Parent PID: 6388

General

Start time (UTC):	10:03:35
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 scanx86
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 6397, Parent PID: 6388

General

Start time (UTC):	10:03:36
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6397, Parent PID: 6388

General

Start time (UTC):	10:03:36
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 scanx86
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 6398, Parent PID: 6263

General

Start time (UTC):	10:03:37
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 6398, Parent PID: 6263

General

Start time (UTC):	10:03:37
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 MISAKI-U79OL \|\| busybox pkill -9 MISAKI-U79OL"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6400, Parent PID: 6398

General

Start time (UTC):	10:03:37
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6400, Parent PID: 6398

General

Start time (UTC):	10:03:37
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 MISAKI-U79OL
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6401, Parent PID: 6398

General

Start time (UTC):	10:03:39
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6401, Parent PID: 6398

General

Start time (UTC):	10:03:39
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 MISAKI-U79OL
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 6402, Parent PID: 6263

General

Start time (UTC):	10:03:40
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 6402, Parent PID: 6263

General

Start time (UTC):	10:03:40
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 foAxi102kxe \|\| busybox pkill -9 foAxi102kxe"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6404, Parent PID: 6402

General

Start time (UTC):	10:03:40
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6404, Parent PID: 6402

General

Start time (UTC):	10:03:40
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 foAxi102kxe
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6407, Parent PID: 6402

General

Start time (UTC):	10:03:41
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6407, Parent PID: 6402

General

Start time (UTC):	10:03:41
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 foAxi102kxe
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 6408, Parent PID: 6263

General

Start time (UTC):	10:03:42
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 6408, Parent PID: 6263

General

Start time (UTC):	10:03:42
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 swodjwodjwoj \|\| busybox pkill -9 swodjwodjwoj"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6410, Parent PID: 6408

General

Start time (UTC):	10:03:42
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6410, Parent PID: 6408

General

Start time (UTC):	10:03:42
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 swodjwodjwoj
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6411, Parent PID: 6408

General

Start time (UTC):	10:03:43
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6411, Parent PID: 6408

General

Start time (UTC):	10:03:43
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 swodjwodjwoj
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 6412, Parent PID: 6263

General

Start time (UTC):	10:03:44
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 6412, Parent PID: 6263

General

Start time (UTC):	10:03:44
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 MmKiy7f87l \|\| busybox pkill -9 MmKiy7f87l"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6417, Parent PID: 6412

General

Start time (UTC):	10:03:44
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6417, Parent PID: 6412

General

Start time (UTC):	10:03:44
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 MmKiy7f87l
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6418, Parent PID: 6412

General

Start time (UTC):	10:03:45
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6418, Parent PID: 6412

General

Start time (UTC):	10:03:45
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 MmKiy7f87l
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 6421, Parent PID: 6263

General

Start time (UTC):	10:03:46
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 6421, Parent PID: 6263

General

Start time (UTC):	10:03:46
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 freecookiex86 \|\| busybox pkill -9 freecookiex86"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6423, Parent PID: 6421

General

Start time (UTC):	10:03:46
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6423, Parent PID: 6421

General

Start time (UTC):	10:03:46
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 freecookiex86
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6424, Parent PID: 6421

General

Start time (UTC):	10:03:48
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6424, Parent PID: 6421

General

Start time (UTC):	10:03:48
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 freecookiex86
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 6427, Parent PID: 6263

General

Start time (UTC):	10:03:49
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 6427, Parent PID: 6263

General

Start time (UTC):	10:03:49
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 sysgpu \|\| busybox pkill -9 sysgpu"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6432, Parent PID: 6427

General

Start time (UTC):	10:03:49
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6432, Parent PID: 6427

General

Start time (UTC):	10:03:49
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 sysgpu
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6433, Parent PID: 6427

General

Start time (UTC):	10:03:50
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6433, Parent PID: 6427

General

Start time (UTC):	10:03:50
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 sysgpu
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 6436, Parent PID: 6263

General

Start time (UTC):	10:03:51
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 6436, Parent PID: 6263

General

Start time (UTC):	10:03:51
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 NiGGeR69xd \|\| busybox pkill -9 NiGGeR69xd"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6438, Parent PID: 6436

General

Start time (UTC):	10:03:51
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6438, Parent PID: 6436

General

Start time (UTC):	10:03:51
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 NiGGeR69xd
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6439, Parent PID: 6436

General

Start time (UTC):	10:03:52
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6439, Parent PID: 6436

General

Start time (UTC):	10:03:52
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 NiGGeR69xd
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 6440, Parent PID: 6263

General

Start time (UTC):	10:03:53
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 6440, Parent PID: 6263

General

Start time (UTC):	10:03:53
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 frgege \|\| busybox pkill -9 frgege"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6442, Parent PID: 6440

General

Start time (UTC):	10:03:53
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6442, Parent PID: 6440

General

Start time (UTC):	10:03:53
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 frgege
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6443, Parent PID: 6440

General

Start time (UTC):	10:03:55
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6443, Parent PID: 6440

General

Start time (UTC):	10:03:55
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 frgege
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 6444, Parent PID: 6263

General

Start time (UTC):	10:03:56
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 6444, Parent PID: 6263

General

Start time (UTC):	10:03:56
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 sysupdater \|\| busybox pkill -9 sysupdater"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6450, Parent PID: 6444

General

Start time (UTC):	10:03:56
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6450, Parent PID: 6444

General

Start time (UTC):	10:03:56
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 sysupdater
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6453, Parent PID: 6444

General

Start time (UTC):	10:03:57
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6453, Parent PID: 6444

General

Start time (UTC):	10:03:57
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 sysupdater
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 6454, Parent PID: 6263

General

Start time (UTC):	10:03:58
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 6454, Parent PID: 6263

General

Start time (UTC):	10:03:58
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 0DnAzepd \|\| busybox pkill -9 0DnAzepd"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6456, Parent PID: 6454

General

Start time (UTC):	10:03:58
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6456, Parent PID: 6454

General

Start time (UTC):	10:03:58
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 0DnAzepd
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6457, Parent PID: 6454

General

Start time (UTC):	10:03:59
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6457, Parent PID: 6454

General

Start time (UTC):	10:03:59
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 0DnAzepd
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 6458, Parent PID: 6263

General

Start time (UTC):	10:04:00
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 6458, Parent PID: 6263

General

Start time (UTC):	10:04:00
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 NiGGeRD0nks69 \|\| busybox pkill -9 NiGGeRD0nks69"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6460, Parent PID: 6458

General

Start time (UTC):	10:04:00
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6460, Parent PID: 6458

General

Start time (UTC):	10:04:00
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 NiGGeRD0nks69
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6463, Parent PID: 6458

General

Start time (UTC):	10:04:01
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6463, Parent PID: 6458

General

Start time (UTC):	10:04:01
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 NiGGeRD0nks69
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 6464, Parent PID: 6263

General

Start time (UTC):	10:04:02
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 6464, Parent PID: 6263

General

Start time (UTC):	10:04:02
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 frgreu \|\| busybox pkill -9 frgreu"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6466, Parent PID: 6464

General

Start time (UTC):	10:04:02
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6466, Parent PID: 6464

General

Start time (UTC):	10:04:02
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 frgreu
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6467, Parent PID: 6464

General

Start time (UTC):	10:04:04
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6467, Parent PID: 6464

General

Start time (UTC):	10:04:04
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 frgreu
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 6469, Parent PID: 6263

General

Start time (UTC):	10:04:05
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 6469, Parent PID: 6263

General

Start time (UTC):	10:04:05
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 telnetd \|\| busybox pkill -9 telnetd"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6475, Parent PID: 6469

General

Start time (UTC):	10:04:05
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6475, Parent PID: 6469

General

Start time (UTC):	10:04:05
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 telnetd
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6478, Parent PID: 6469

General

Start time (UTC):	10:04:06
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6478, Parent PID: 6469

General

Start time (UTC):	10:04:06
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 telnetd
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 6479, Parent PID: 6263

General

Start time (UTC):	10:04:07
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 6479, Parent PID: 6263

General

Start time (UTC):	10:04:07
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 0x766f6964 \|\| busybox pkill -9 0x766f6964"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6484, Parent PID: 6479

General

Start time (UTC):	10:04:07
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6484, Parent PID: 6479

General

Start time (UTC):	10:04:07
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 0x766f6964
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6485, Parent PID: 6479

General

Start time (UTC):	10:04:08
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6485, Parent PID: 6479

General

Start time (UTC):	10:04:08
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 0x766f6964
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 6486, Parent PID: 6263

General

Start time (UTC):	10:04:09
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 6486, Parent PID: 6263

General

Start time (UTC):	10:04:09
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 NiGGeRd0nks1337 \|\| busybox pkill -9 NiGGeRd0nks1337"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6488, Parent PID: 6486

General

Start time (UTC):	10:04:09
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6488, Parent PID: 6486

General

Start time (UTC):	10:04:09
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 NiGGeRd0nks1337
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6489, Parent PID: 6486

General

Start time (UTC):	10:04:10
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6489, Parent PID: 6486

General

Start time (UTC):	10:04:10
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 NiGGeRd0nks1337
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 6492, Parent PID: 6263

General

Start time (UTC):	10:04:11
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 6492, Parent PID: 6263

General

Start time (UTC):	10:04:11
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 gaft \|\| busybox pkill -9 gaft"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6497, Parent PID: 6492

General

Start time (UTC):	10:04:11
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6497, Parent PID: 6492

General

Start time (UTC):	10:04:11
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 gaft
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6498, Parent PID: 6492

General

Start time (UTC):	10:04:13
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6498, Parent PID: 6492

General

Start time (UTC):	10:04:13
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 gaft
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 6499, Parent PID: 6263

General

Start time (UTC):	10:04:14
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 6499, Parent PID: 6263

General

Start time (UTC):	10:04:14
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 urasgbsigboa \|\| busybox pkill -9 urasgbsigboa"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6503, Parent PID: 6499

General

Start time (UTC):	10:04:14
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6503, Parent PID: 6499

General

Start time (UTC):	10:04:14
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 urasgbsigboa
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6505, Parent PID: 6499

General

Start time (UTC):	10:04:15
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6505, Parent PID: 6499

General

Start time (UTC):	10:04:15
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 urasgbsigboa
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 6508, Parent PID: 6263

General

Start time (UTC):	10:04:16
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 6508, Parent PID: 6263

General

Start time (UTC):	10:04:16
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 120i3UI49 \|\| busybox pkill -9 120i3UI49"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6512, Parent PID: 6508

General

Start time (UTC):	10:04:16
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6512, Parent PID: 6508

General

Start time (UTC):	10:04:16
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 120i3UI49
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6514, Parent PID: 6508

General

Start time (UTC):	10:04:18
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6514, Parent PID: 6508

General

Start time (UTC):	10:04:18
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 120i3UI49
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 6515, Parent PID: 6263

General

Start time (UTC):	10:04:19
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 6515, Parent PID: 6263

General

Start time (UTC):	10:04:19
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 OaF3 \|\| busybox pkill -9 OaF3"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6520, Parent PID: 6515

General

Start time (UTC):	10:04:19
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6520, Parent PID: 6515

General

Start time (UTC):	10:04:19
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 OaF3
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6521, Parent PID: 6515

General

Start time (UTC):	10:04:20
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6521, Parent PID: 6515

General

Start time (UTC):	10:04:20
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 OaF3
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 6524, Parent PID: 6263

General

Start time (UTC):	10:04:21
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 6524, Parent PID: 6263

General

Start time (UTC):	10:04:21
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 geae \|\| busybox pkill -9 geae"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6530, Parent PID: 6524

General

Start time (UTC):	10:04:21
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6530, Parent PID: 6524

General

Start time (UTC):	10:04:21
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 geae
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6531, Parent PID: 6524

General

Start time (UTC):	10:04:22
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6531, Parent PID: 6524

General

Start time (UTC):	10:04:22
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 geae
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 6532, Parent PID: 6263

General

Start time (UTC):	10:04:23
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 6532, Parent PID: 6263

General

Start time (UTC):	10:04:23
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 vaiolmao \|\| busybox pkill -9 vaiolmao"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6537, Parent PID: 6532

General

Start time (UTC):	10:04:23
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6537, Parent PID: 6532

General

Start time (UTC):	10:04:23
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 vaiolmao
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6538, Parent PID: 6532

General

Start time (UTC):	10:04:24
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6538, Parent PID: 6532

General

Start time (UTC):	10:04:24
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 vaiolmao
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 6539, Parent PID: 6263

General

Start time (UTC):	10:04:25
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 6539, Parent PID: 6263

General

Start time (UTC):	10:04:25
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 123123a \|\| busybox pkill -9 123123a"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6544, Parent PID: 6539

General

Start time (UTC):	10:04:25
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6544, Parent PID: 6539

General

Start time (UTC):	10:04:25
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 123123a
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6547, Parent PID: 6539

General

Start time (UTC):	10:04:27
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6547, Parent PID: 6539

General

Start time (UTC):	10:04:27
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 123123a
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 6548, Parent PID: 6263

General

Start time (UTC):	10:04:28
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 6548, Parent PID: 6263

General

Start time (UTC):	10:04:28
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 Ofurain0n4H34D \|\| busybox pkill -9 Ofurain0n4H34D"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6553, Parent PID: 6548

General

Start time (UTC):	10:04:28
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6553, Parent PID: 6548

General

Start time (UTC):	10:04:28
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 Ofurain0n4H34D
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6554, Parent PID: 6548

General

Start time (UTC):	10:04:29
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6554, Parent PID: 6548

General

Start time (UTC):	10:04:29
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 Ofurain0n4H34D
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 6555, Parent PID: 6263

General

Start time (UTC):	10:04:30
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 6555, Parent PID: 6263

General

Start time (UTC):	10:04:30
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 ggTrex \|\| busybox pkill -9 ggTrex"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6560, Parent PID: 6555

General

Start time (UTC):	10:04:30
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6560, Parent PID: 6555

General

Start time (UTC):	10:04:30
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 ggTrex
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6563, Parent PID: 6555

General

Start time (UTC):	10:04:31
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6563, Parent PID: 6555

General

Start time (UTC):	10:04:31
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 ggTrex
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 6564, Parent PID: 6263

General

Start time (UTC):	10:04:32
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 6564, Parent PID: 6263

General

Start time (UTC):	10:04:32
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 wasads \|\| busybox pkill -9 wasads"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6566, Parent PID: 6564

General

Start time (UTC):	10:04:32
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6566, Parent PID: 6564

General

Start time (UTC):	10:04:32
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 wasads
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6568, Parent PID: 6564

General

Start time (UTC):	10:04:33
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6568, Parent PID: 6564

General

Start time (UTC):	10:04:33
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 wasads
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 6570, Parent PID: 6263

General

Start time (UTC):	10:04:34
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 6570, Parent PID: 6263

General

Start time (UTC):	10:04:34
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 1293194hjXD \|\| busybox pkill -9 1293194hjXD"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6576, Parent PID: 6570

General

Start time (UTC):	10:04:34
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6576, Parent PID: 6570

General

Start time (UTC):	10:04:34
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 1293194hjXD
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6577, Parent PID: 6570

General

Start time (UTC):	10:04:35
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6577, Parent PID: 6570

General

Start time (UTC):	10:04:35
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 1293194hjXD
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 6580, Parent PID: 6263

General

Start time (UTC):	10:04:37
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 6580, Parent PID: 6263

General

Start time (UTC):	10:04:37
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 OthLaLosn \|\| busybox pkill -9 OthLaLosn"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6585, Parent PID: 6580

General

Start time (UTC):	10:04:37
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6585, Parent PID: 6580

General

Start time (UTC):	10:04:37
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 OthLaLosn
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6586, Parent PID: 6580

General

Start time (UTC):	10:04:38
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6586, Parent PID: 6580

General

Start time (UTC):	10:04:38
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 OthLaLosn
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 6587, Parent PID: 6263

General

Start time (UTC):	10:04:39
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 6587, Parent PID: 6263

General

Start time (UTC):	10:04:39
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 ggt \|\| busybox pkill -9 ggt"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6592, Parent PID: 6587

General

Start time (UTC):	10:04:39
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6592, Parent PID: 6587

General

Start time (UTC):	10:04:39
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 ggt
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6593, Parent PID: 6587

General

Start time (UTC):	10:04:40
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6593, Parent PID: 6587

General

Start time (UTC):	10:04:40
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 ggt
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 6596, Parent PID: 6263

General

Start time (UTC):	10:04:41
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 6596, Parent PID: 6263

General

Start time (UTC):	10:04:41
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 wget-log \|\| busybox pkill -9 wget-log"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6601, Parent PID: 6596

General

Start time (UTC):	10:04:41
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6601, Parent PID: 6596

General

Start time (UTC):	10:04:41
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 wget-log
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6602, Parent PID: 6596

General

Start time (UTC):	10:04:42
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6602, Parent PID: 6596

General

Start time (UTC):	10:04:42
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 wget-log
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 6603, Parent PID: 6263

General

Start time (UTC):	10:04:43
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 6603, Parent PID: 6263

General

Start time (UTC):	10:04:43
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 1337SoraLOADER \|\| busybox pkill -9 1337SoraLOADER"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6608, Parent PID: 6603

General

Start time (UTC):	10:04:43
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6608, Parent PID: 6603

General

Start time (UTC):	10:04:43
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 1337SoraLOADER
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6609, Parent PID: 6603

General

Start time (UTC):	10:04:44
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6609, Parent PID: 6603

General

Start time (UTC):	10:04:44
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 1337SoraLOADER
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 6610, Parent PID: 6263

General

Start time (UTC):	10:04:45
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 6610, Parent PID: 6263

General

Start time (UTC):	10:04:45
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 SAIAKINA \|\| busybox pkill -9 SAIAKINA"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6615, Parent PID: 6610

General

Start time (UTC):	10:04:45
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6615, Parent PID: 6610

General

Start time (UTC):	10:04:45
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 SAIAKINA
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6618, Parent PID: 6610

General

Start time (UTC):	10:04:46
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6618, Parent PID: 6610

General

Start time (UTC):	10:04:46
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 SAIAKINA
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 6619, Parent PID: 6263

General

Start time (UTC):	10:04:48
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 6619, Parent PID: 6263

General

Start time (UTC):	10:04:48
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 ggtq \|\| busybox pkill -9 ggtq"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6621, Parent PID: 6619

General

Start time (UTC):	10:04:48
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6621, Parent PID: 6619

General

Start time (UTC):	10:04:48
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 ggtq
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6624, Parent PID: 6619

General

Start time (UTC):	10:04:48
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6624, Parent PID: 6619

General

Start time (UTC):	10:04:48
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 ggtq
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 6625, Parent PID: 6263

General

Start time (UTC):	10:04:49
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 6625, Parent PID: 6263

General

Start time (UTC):	10:04:49
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 1378bfp919GRB1Q2 \|\| busybox pkill -9 1378bfp919GRB1Q2"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6631, Parent PID: 6625

General

Start time (UTC):	10:04:50
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6631, Parent PID: 6625

General

Start time (UTC):	10:04:50
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 1378bfp919GRB1Q2
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6632, Parent PID: 6625

General

Start time (UTC):	10:04:51
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6632, Parent PID: 6625

General

Start time (UTC):	10:04:51
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 1378bfp919GRB1Q2
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 6635, Parent PID: 6263

General

Start time (UTC):	10:04:52
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 6635, Parent PID: 6263

General

Start time (UTC):	10:04:52
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 SAIAKUSO \|\| busybox pkill -9 SAIAKUSO"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6640, Parent PID: 6635

General

Start time (UTC):	10:04:52
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6640, Parent PID: 6635

General

Start time (UTC):	10:04:52
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 SAIAKUSO
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6641, Parent PID: 6635

General

Start time (UTC):	10:04:53
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6641, Parent PID: 6635

General

Start time (UTC):	10:04:53
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 SAIAKUSO
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 6642, Parent PID: 6263

General

Start time (UTC):	10:04:54
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 6642, Parent PID: 6263

General

Start time (UTC):	10:04:54
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 ggtr \|\| busybox pkill -9 ggtr"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6647, Parent PID: 6642

General

Start time (UTC):	10:04:54
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6647, Parent PID: 6642

General

Start time (UTC):	10:04:54
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 ggtr
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6648, Parent PID: 6642

General

Start time (UTC):	10:04:56
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6648, Parent PID: 6642

General

Start time (UTC):	10:04:56
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 ggtr
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 6651, Parent PID: 6263

General

Start time (UTC):	10:04:57
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 6651, Parent PID: 6263

General

Start time (UTC):	10:04:57
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 14Fa \|\| busybox pkill -9 14Fa"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6653, Parent PID: 6651

General

Start time (UTC):	10:04:57
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6653, Parent PID: 6651

General

Start time (UTC):	10:04:57
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 14Fa
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6654, Parent PID: 6651

General

Start time (UTC):	10:04:58
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6654, Parent PID: 6651

General

Start time (UTC):	10:04:58
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 14Fa
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 6655, Parent PID: 6263

General

Start time (UTC):	10:04:59
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 6655, Parent PID: 6263

General

Start time (UTC):	10:04:59
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 SEXSLAVE1337 \|\| busybox pkill -9 SEXSLAVE1337"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6660, Parent PID: 6655

General

Start time (UTC):	10:04:59
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6660, Parent PID: 6655

General

Start time (UTC):	10:04:59
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 SEXSLAVE1337
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6661, Parent PID: 6655

General

Start time (UTC):	10:05:00
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6661, Parent PID: 6655

General

Start time (UTC):	10:05:00
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 SEXSLAVE1337
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 6664, Parent PID: 6263

General

Start time (UTC):	10:05:01
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 6664, Parent PID: 6263

General

Start time (UTC):	10:05:02
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 ggtt \|\| busybox pkill -9 ggtt"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6666, Parent PID: 6664

General

Start time (UTC):	10:05:02
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6666, Parent PID: 6664

General

Start time (UTC):	10:05:02
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 ggtt
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6667, Parent PID: 6664

General

Start time (UTC):	10:05:03
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6667, Parent PID: 6664

General

Start time (UTC):	10:05:03
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 ggtt
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.m68k.elf PID: 6668, Parent PID: 6263

General

Start time (UTC):	10:05:04
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.m68k.elf
Arguments:	-
File size:	4463432 bytes
MD5 hash:	cd177594338c77b895ae27c33f8f86cc

Analysis Process: sh PID: 6668, Parent PID: 6263

General

Start time (UTC):	10:05:04
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 1902a3u912u3u4 \|\| busybox pkill -9 1902a3u912u3u4"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6673, Parent PID: 6668

General

Start time (UTC):	10:05:04
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6673, Parent PID: 6668

General

Start time (UTC):	10:05:04
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 1902a3u912u3u4
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained. Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism. Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes.
Tactics:	Credential Access
Data Sources:	Application Log: Application Log Content, Command: Command Execution, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report yakuza.m68k.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Network Port Distribution

TCP Packets

IRC Packets

System Behavior

Analysis Process: yakuza.m68k.elf PID: 6261, Parent PID: 6184

General

Chronological Activities

Analysis Process: yakuza.m68k.elf PID: 6263, Parent PID: 6261

General

Chronological Activities

Analysis Process: yakuza.m68k.elf PID: 6269, Parent PID: 6263

General

Chronological Activities

Analysis Process: yakuza.m68k.elf PID: 6270, Parent PID: 6263

General

Chronological Activities

Analysis Process: yakuza.m68k.elf PID: 6272, Parent PID: 6263

General

Chronological Activities

Analysis Process: sh PID: 6272, Parent PID: 6263

Linux Analysis Report
yakuza.m68k.elf