Edit tour

Linux Analysis Report
yakuza.ppc.elf

Overview

General Information

Sample name:	yakuza.ppc.elf
Analysis ID:	1561402
MD5:	79634876f190036b8b502b18ec19091d
SHA1:	ec5522c01efaede1145fe409c27446e900c48d70
SHA256:	b6fa1de9fec1861ce91022f270fa05bada43174ea8b35aca238e330ead60c0b8
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	72
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Uses IRC for communication with a C&C

Uses known network protocols on non-standard ports

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "kill" or "pkill" command typically used to terminate processes

Reads CPU information from /sys indicative of miner or evasive malware

Sample and/or dropped files contains symbols with suspicious names

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample contains strings indicative of password brute-forcing capabilities

Sample contains strings that are user agent strings indicative of HTTP manipulation

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1561402
Start date and time:	2024-11-23 11:02:13 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 34s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	yakuza.ppc.elf
Detection:	MAL
Classification:	mal72.troj.linELF@0/0@0/0

Warnings

Report size exceeded maximum capacity and may have missing behavior information.

Runtime Messages

Command:	/tmp/yakuza.ppc.elf
PID:	5527
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	CAPSAICIN
Standard Error:

Process Tree

system is lnxubuntu20

yakuza.ppc.elf (PID: 5527, Parent: 5446, MD5: ae65271c943d3451b7f026d1fadccea6) Arguments: /tmp/yakuza.ppc.elf

yakuza.ppc.elf New Fork (PID: 5529, Parent: 5527)

yakuza.ppc.elf New Fork (PID: 5531, Parent: 5529)

yakuza.ppc.elf New Fork (PID: 5533, Parent: 5529)

yakuza.ppc.elf New Fork (PID: 5535, Parent: 5529)

sh (PID: 5535, Parent: 5529, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 902i13 || busybox pkill -9 902i13"

sh New Fork (PID: 5541, Parent: 5535)

pkill (PID: 5541, Parent: 5535, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 902i13

sh New Fork (PID: 5542, Parent: 5535)

busybox (PID: 5542, Parent: 5535, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 902i13

yakuza.ppc.elf New Fork (PID: 5545, Parent: 5529)

sh (PID: 5545, Parent: 5529, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 BzSxLxBxeY || busybox pkill -9 BzSxLxBxeY"

sh New Fork (PID: 5550, Parent: 5545)

pkill (PID: 5550, Parent: 5545, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 BzSxLxBxeY

sh New Fork (PID: 5551, Parent: 5545)

busybox (PID: 5551, Parent: 5545, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 BzSxLxBxeY

yakuza.ppc.elf New Fork (PID: 5552, Parent: 5529)

sh (PID: 5552, Parent: 5529, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 HOHO-LUGO7 || busybox pkill -9 HOHO-LUGO7"

sh New Fork (PID: 5557, Parent: 5552)

pkill (PID: 5557, Parent: 5552, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 HOHO-LUGO7

sh New Fork (PID: 5560, Parent: 5552)

busybox (PID: 5560, Parent: 5552, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 HOHO-LUGO7

yakuza.ppc.elf New Fork (PID: 5561, Parent: 5529)

sh (PID: 5561, Parent: 5529, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 HOHO-U79OL || busybox pkill -9 HOHO-U79OL"

sh New Fork (PID: 5566, Parent: 5561)

pkill (PID: 5566, Parent: 5561, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 HOHO-U79OL

sh New Fork (PID: 5567, Parent: 5561)

busybox (PID: 5567, Parent: 5561, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 HOHO-U79OL

yakuza.ppc.elf New Fork (PID: 5568, Parent: 5529)

sh (PID: 5568, Parent: 5529, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 JuYfouyf87 || busybox pkill -9 JuYfouyf87"

sh New Fork (PID: 5570, Parent: 5568)

pkill (PID: 5570, Parent: 5568, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 JuYfouyf87

sh New Fork (PID: 5573, Parent: 5568)

busybox (PID: 5573, Parent: 5568, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 JuYfouyf87

yakuza.ppc.elf New Fork (PID: 5574, Parent: 5529)

sh (PID: 5574, Parent: 5529, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 NiGGeR69xd || busybox pkill -9 NiGGeR69xd"

sh New Fork (PID: 5576, Parent: 5574)

pkill (PID: 5576, Parent: 5574, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 NiGGeR69xd

sh New Fork (PID: 5577, Parent: 5574)

busybox (PID: 5577, Parent: 5574, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 NiGGeR69xd

yakuza.ppc.elf New Fork (PID: 5578, Parent: 5529)

sh (PID: 5578, Parent: 5529, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 SO190Ij1X || busybox pkill -9 SO190Ij1X"

sh New Fork (PID: 5584, Parent: 5578)

pkill (PID: 5584, Parent: 5578, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 SO190Ij1X

sh New Fork (PID: 5587, Parent: 5578)

busybox (PID: 5587, Parent: 5578, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 SO190Ij1X

yakuza.ppc.elf New Fork (PID: 5588, Parent: 5529)

sh (PID: 5588, Parent: 5529, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 LOLKIKEEEDDE || busybox pkill -9 LOLKIKEEEDDE"

sh New Fork (PID: 5590, Parent: 5588)

pkill (PID: 5590, Parent: 5588, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 LOLKIKEEEDDE

sh New Fork (PID: 5610, Parent: 5588)

busybox (PID: 5610, Parent: 5588, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 LOLKIKEEEDDE

yakuza.ppc.elf New Fork (PID: 5611, Parent: 5529)

sh (PID: 5611, Parent: 5529, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 ekjheory98e || busybox pkill -9 ekjheory98e"

sh New Fork (PID: 5616, Parent: 5611)

pkill (PID: 5616, Parent: 5611, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 ekjheory98e

sh New Fork (PID: 5619, Parent: 5611)

busybox (PID: 5619, Parent: 5611, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 ekjheory98e

yakuza.ppc.elf New Fork (PID: 5620, Parent: 5529)

sh (PID: 5620, Parent: 5529, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 scansh4 || busybox pkill -9 scansh4"

sh New Fork (PID: 5622, Parent: 5620)

pkill (PID: 5622, Parent: 5620, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 scansh4

sh New Fork (PID: 5623, Parent: 5620)

busybox (PID: 5623, Parent: 5620, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 scansh4

yakuza.ppc.elf New Fork (PID: 5624, Parent: 5529)

sh (PID: 5624, Parent: 5529, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 MDMA || busybox pkill -9 MDMA"

sh New Fork (PID: 5626, Parent: 5624)

pkill (PID: 5626, Parent: 5624, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 MDMA

sh New Fork (PID: 5630, Parent: 5624)

busybox (PID: 5630, Parent: 5624, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 MDMA

yakuza.ppc.elf New Fork (PID: 5631, Parent: 5529)

sh (PID: 5631, Parent: 5529, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 fdevalvex || busybox pkill -9 fdevalvex"

sh New Fork (PID: 5637, Parent: 5631)

pkill (PID: 5637, Parent: 5631, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 fdevalvex

sh New Fork (PID: 5638, Parent: 5631)

busybox (PID: 5638, Parent: 5631, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 fdevalvex

yakuza.ppc.elf New Fork (PID: 5639, Parent: 5529)

sh (PID: 5639, Parent: 5529, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 scanspc || busybox pkill -9 scanspc"

sh New Fork (PID: 5644, Parent: 5639)

pkill (PID: 5644, Parent: 5639, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 scanspc

sh New Fork (PID: 5647, Parent: 5639)

busybox (PID: 5647, Parent: 5639, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 scanspc

yakuza.ppc.elf New Fork (PID: 5648, Parent: 5529)

sh (PID: 5648, Parent: 5529, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 MELTEDNINJAREALZ || busybox pkill -9 MELTEDNINJAREALZ"

sh New Fork (PID: 5653, Parent: 5648)

pkill (PID: 5653, Parent: 5648, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 MELTEDNINJAREALZ

sh New Fork (PID: 5654, Parent: 5648)

busybox (PID: 5654, Parent: 5648, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 MELTEDNINJAREALZ

yakuza.ppc.elf New Fork (PID: 5655, Parent: 5529)

sh (PID: 5655, Parent: 5529, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 flexsonskids || busybox pkill -9 flexsonskids"

sh New Fork (PID: 5659, Parent: 5655)

pkill (PID: 5659, Parent: 5655, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 flexsonskids

sh New Fork (PID: 5663, Parent: 5655)

busybox (PID: 5663, Parent: 5655, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 flexsonskids

yakuza.ppc.elf New Fork (PID: 5664, Parent: 5529)

sh (PID: 5664, Parent: 5529, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 scanx86 || busybox pkill -9 scanx86"

sh New Fork (PID: 5669, Parent: 5664)

pkill (PID: 5669, Parent: 5664, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 scanx86

sh New Fork (PID: 5670, Parent: 5664)

busybox (PID: 5670, Parent: 5664, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 scanx86

yakuza.ppc.elf New Fork (PID: 5671, Parent: 5529)

sh (PID: 5671, Parent: 5529, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 MISAKI-U79OL || busybox pkill -9 MISAKI-U79OL"

sh New Fork (PID: 5673, Parent: 5671)

pkill (PID: 5673, Parent: 5671, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 MISAKI-U79OL

sh New Fork (PID: 5676, Parent: 5671)

busybox (PID: 5676, Parent: 5671, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 MISAKI-U79OL

yakuza.ppc.elf New Fork (PID: 5677, Parent: 5529)

sh (PID: 5677, Parent: 5529, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 foAxi102kxe || busybox pkill -9 foAxi102kxe"

sh New Fork (PID: 5679, Parent: 5677)

pkill (PID: 5679, Parent: 5677, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 foAxi102kxe

sh New Fork (PID: 5680, Parent: 5677)

busybox (PID: 5680, Parent: 5677, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 foAxi102kxe

yakuza.ppc.elf New Fork (PID: 5681, Parent: 5529)

sh (PID: 5681, Parent: 5529, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 swodjwodjwoj || busybox pkill -9 swodjwodjwoj"

sh New Fork (PID: 5689, Parent: 5681)

pkill (PID: 5689, Parent: 5681, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 swodjwodjwoj

sh New Fork (PID: 5690, Parent: 5681)

busybox (PID: 5690, Parent: 5681, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 swodjwodjwoj

yakuza.ppc.elf New Fork (PID: 5691, Parent: 5529)

sh (PID: 5691, Parent: 5529, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 MmKiy7f87l || busybox pkill -9 MmKiy7f87l"

sh New Fork (PID: 5696, Parent: 5691)

pkill (PID: 5696, Parent: 5691, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 MmKiy7f87l

sh New Fork (PID: 5699, Parent: 5691)

busybox (PID: 5699, Parent: 5691, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 MmKiy7f87l

yakuza.ppc.elf New Fork (PID: 5700, Parent: 5529)

sh (PID: 5700, Parent: 5529, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 freecookiex86 || busybox pkill -9 freecookiex86"

sh New Fork (PID: 5707, Parent: 5700)

pkill (PID: 5707, Parent: 5700, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 freecookiex86

sh New Fork (PID: 5708, Parent: 5700)

busybox (PID: 5708, Parent: 5700, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 freecookiex86

yakuza.ppc.elf New Fork (PID: 5709, Parent: 5529)

sh (PID: 5709, Parent: 5529, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 sysgpu || busybox pkill -9 sysgpu"

sh New Fork (PID: 5714, Parent: 5709)

pkill (PID: 5714, Parent: 5709, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 sysgpu

sh New Fork (PID: 5715, Parent: 5709)

busybox (PID: 5715, Parent: 5709, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 sysgpu

yakuza.ppc.elf New Fork (PID: 5716, Parent: 5529)

sh (PID: 5716, Parent: 5529, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 NiGGeR69xd || busybox pkill -9 NiGGeR69xd"

sh New Fork (PID: 5718, Parent: 5716)

pkill (PID: 5718, Parent: 5716, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 NiGGeR69xd

sh New Fork (PID: 5722, Parent: 5716)

busybox (PID: 5722, Parent: 5716, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 NiGGeR69xd

yakuza.ppc.elf New Fork (PID: 5723, Parent: 5529)

sh (PID: 5723, Parent: 5529, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 frgege || busybox pkill -9 frgege"

sh New Fork (PID: 5729, Parent: 5723)

pkill (PID: 5729, Parent: 5723, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 frgege

sh New Fork (PID: 5730, Parent: 5723)

busybox (PID: 5730, Parent: 5723, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 frgege

yakuza.ppc.elf New Fork (PID: 5731, Parent: 5529)

sh (PID: 5731, Parent: 5529, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 sysupdater || busybox pkill -9 sysupdater"

sh New Fork (PID: 5733, Parent: 5731)

pkill (PID: 5733, Parent: 5731, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 sysupdater

sh New Fork (PID: 5736, Parent: 5731)

busybox (PID: 5736, Parent: 5731, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 sysupdater

yakuza.ppc.elf New Fork (PID: 5737, Parent: 5529)

sh (PID: 5737, Parent: 5529, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 0DnAzepd || busybox pkill -9 0DnAzepd"

sh New Fork (PID: 5739, Parent: 5737)

pkill (PID: 5739, Parent: 5737, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 0DnAzepd

sh New Fork (PID: 5740, Parent: 5737)

busybox (PID: 5740, Parent: 5737, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 0DnAzepd

yakuza.ppc.elf New Fork (PID: 5741, Parent: 5529)

sh (PID: 5741, Parent: 5529, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 NiGGeRD0nks69 || busybox pkill -9 NiGGeRD0nks69"

sh New Fork (PID: 5746, Parent: 5741)

pkill (PID: 5746, Parent: 5741, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 NiGGeRD0nks69

sh New Fork (PID: 5749, Parent: 5741)

busybox (PID: 5749, Parent: 5741, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 NiGGeRD0nks69

yakuza.ppc.elf New Fork (PID: 5750, Parent: 5529)

sh (PID: 5750, Parent: 5529, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 frgreu || busybox pkill -9 frgreu"

sh New Fork (PID: 5752, Parent: 5750)

pkill (PID: 5752, Parent: 5750, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 frgreu

sh New Fork (PID: 5753, Parent: 5750)

busybox (PID: 5753, Parent: 5750, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 frgreu

yakuza.ppc.elf New Fork (PID: 5754, Parent: 5529)

sh (PID: 5754, Parent: 5529, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 telnetd || busybox pkill -9 telnetd"

sh New Fork (PID: 5756, Parent: 5754)

pkill (PID: 5756, Parent: 5754, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 telnetd

sh New Fork (PID: 5759, Parent: 5754)

busybox (PID: 5759, Parent: 5754, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 telnetd

yakuza.ppc.elf New Fork (PID: 5760, Parent: 5529)

sh (PID: 5760, Parent: 5529, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 0x766f6964 || busybox pkill -9 0x766f6964"

sh New Fork (PID: 5762, Parent: 5760)

pkill (PID: 5762, Parent: 5760, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 0x766f6964

sh New Fork (PID: 5763, Parent: 5760)

busybox (PID: 5763, Parent: 5760, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 0x766f6964

yakuza.ppc.elf New Fork (PID: 5764, Parent: 5529)

sh (PID: 5764, Parent: 5529, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 NiGGeRd0nks1337 || busybox pkill -9 NiGGeRd0nks1337"

sh New Fork (PID: 5766, Parent: 5764)

pkill (PID: 5766, Parent: 5764, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 NiGGeRd0nks1337

sh New Fork (PID: 5769, Parent: 5764)

busybox (PID: 5769, Parent: 5764, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 NiGGeRd0nks1337

yakuza.ppc.elf New Fork (PID: 5770, Parent: 5529)

sh (PID: 5770, Parent: 5529, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 gaft || busybox pkill -9 gaft"

sh New Fork (PID: 5772, Parent: 5770)

pkill (PID: 5772, Parent: 5770, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 gaft

sh New Fork (PID: 5773, Parent: 5770)

busybox (PID: 5773, Parent: 5770, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 gaft

yakuza.ppc.elf New Fork (PID: 5774, Parent: 5529)

sh (PID: 5774, Parent: 5529, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 urasgbsigboa || busybox pkill -9 urasgbsigboa"

sh New Fork (PID: 5780, Parent: 5774)

pkill (PID: 5780, Parent: 5774, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 urasgbsigboa

sh New Fork (PID: 5783, Parent: 5774)

busybox (PID: 5783, Parent: 5774, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 urasgbsigboa

yakuza.ppc.elf New Fork (PID: 5784, Parent: 5529)

sh (PID: 5784, Parent: 5529, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 120i3UI49 || busybox pkill -9 120i3UI49"

sh New Fork (PID: 5786, Parent: 5784)

pkill (PID: 5786, Parent: 5784, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 120i3UI49

sh New Fork (PID: 5787, Parent: 5784)

busybox (PID: 5787, Parent: 5784, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 120i3UI49

yakuza.ppc.elf New Fork (PID: 5788, Parent: 5529)

sh (PID: 5788, Parent: 5529, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 OaF3 || busybox pkill -9 OaF3"

sh New Fork (PID: 5794, Parent: 5788)

pkill (PID: 5794, Parent: 5788, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 OaF3

sh New Fork (PID: 5798, Parent: 5788)

busybox (PID: 5798, Parent: 5788, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 OaF3

yakuza.ppc.elf New Fork (PID: 5799, Parent: 5529)

sh (PID: 5799, Parent: 5529, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 geae || busybox pkill -9 geae"

sh New Fork (PID: 5803, Parent: 5799)

pkill (PID: 5803, Parent: 5799, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 geae

sh New Fork (PID: 5805, Parent: 5799)

busybox (PID: 5805, Parent: 5799, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 geae

yakuza.ppc.elf New Fork (PID: 5806, Parent: 5529)

sh (PID: 5806, Parent: 5529, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 vaiolmao || busybox pkill -9 vaiolmao"

sh New Fork (PID: 5808, Parent: 5806)

pkill (PID: 5808, Parent: 5806, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 vaiolmao

sh New Fork (PID: 5809, Parent: 5806)

busybox (PID: 5809, Parent: 5806, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 vaiolmao

yakuza.ppc.elf New Fork (PID: 5812, Parent: 5529)

sh (PID: 5812, Parent: 5529, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 123123a || busybox pkill -9 123123a"

sh New Fork (PID: 5814, Parent: 5812)

pkill (PID: 5814, Parent: 5812, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 123123a

sh New Fork (PID: 5815, Parent: 5812)

busybox (PID: 5815, Parent: 5812, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 123123a

yakuza.ppc.elf New Fork (PID: 5816, Parent: 5529)

sh (PID: 5816, Parent: 5529, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 Ofurain0n4H34D || busybox pkill -9 Ofurain0n4H34D"

sh New Fork (PID: 5821, Parent: 5816)

pkill (PID: 5821, Parent: 5816, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 Ofurain0n4H34D

sh New Fork (PID: 5822, Parent: 5816)

busybox (PID: 5822, Parent: 5816, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 Ofurain0n4H34D

yakuza.ppc.elf New Fork (PID: 5825, Parent: 5529)

sh (PID: 5825, Parent: 5529, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 ggTrex || busybox pkill -9 ggTrex"

sh New Fork (PID: 5827, Parent: 5825)

pkill (PID: 5827, Parent: 5825, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 ggTrex

sh New Fork (PID: 5828, Parent: 5825)

busybox (PID: 5828, Parent: 5825, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 ggTrex

yakuza.ppc.elf New Fork (PID: 5829, Parent: 5529)

sh (PID: 5829, Parent: 5529, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 wasads || busybox pkill -9 wasads"

sh New Fork (PID: 5831, Parent: 5829)

pkill (PID: 5831, Parent: 5829, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 wasads

sh New Fork (PID: 5832, Parent: 5829)

busybox (PID: 5832, Parent: 5829, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 wasads

yakuza.ppc.elf New Fork (PID: 5835, Parent: 5529)

sh (PID: 5835, Parent: 5529, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 1293194hjXD || busybox pkill -9 1293194hjXD"

sh New Fork (PID: 5841, Parent: 5835)

pkill (PID: 5841, Parent: 5835, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 1293194hjXD

sh New Fork (PID: 5842, Parent: 5835)

busybox (PID: 5842, Parent: 5835, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 1293194hjXD

yakuza.ppc.elf New Fork (PID: 5843, Parent: 5529)

sh (PID: 5843, Parent: 5529, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 OthLaLosn || busybox pkill -9 OthLaLosn"

sh New Fork (PID: 5845, Parent: 5843)

pkill (PID: 5845, Parent: 5843, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 OthLaLosn

sh New Fork (PID: 5846, Parent: 5843)

busybox (PID: 5846, Parent: 5843, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 OthLaLosn

yakuza.ppc.elf New Fork (PID: 5847, Parent: 5529)

sh (PID: 5847, Parent: 5529, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 ggt || busybox pkill -9 ggt"

sh New Fork (PID: 5849, Parent: 5847)

pkill (PID: 5849, Parent: 5847, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 ggt

sh New Fork (PID: 5852, Parent: 5847)

busybox (PID: 5852, Parent: 5847, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 ggt

yakuza.ppc.elf New Fork (PID: 5853, Parent: 5529)

sh (PID: 5853, Parent: 5529, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 wget-log || busybox pkill -9 wget-log"

sh New Fork (PID: 5858, Parent: 5853)

pkill (PID: 5858, Parent: 5853, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 wget-log

sh New Fork (PID: 5861, Parent: 5853)

busybox (PID: 5861, Parent: 5853, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 wget-log

yakuza.ppc.elf New Fork (PID: 5862, Parent: 5529)

sh (PID: 5862, Parent: 5529, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 1337SoraLOADER || busybox pkill -9 1337SoraLOADER"

sh New Fork (PID: 5864, Parent: 5862)

pkill (PID: 5864, Parent: 5862, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 1337SoraLOADER

sh New Fork (PID: 5867, Parent: 5862)

busybox (PID: 5867, Parent: 5862, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 1337SoraLOADER

yakuza.ppc.elf New Fork (PID: 5868, Parent: 5529)

sh (PID: 5868, Parent: 5529, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 SAIAKINA || busybox pkill -9 SAIAKINA"

sh New Fork (PID: 5873, Parent: 5868)

pkill (PID: 5873, Parent: 5868, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 SAIAKINA

sh New Fork (PID: 5874, Parent: 5868)

busybox (PID: 5874, Parent: 5868, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 SAIAKINA

yakuza.ppc.elf New Fork (PID: 5875, Parent: 5529)

sh (PID: 5875, Parent: 5529, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 ggtq || busybox pkill -9 ggtq"

sh New Fork (PID: 5881, Parent: 5875)

pkill (PID: 5881, Parent: 5875, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 ggtq

sh New Fork (PID: 5885, Parent: 5875)

busybox (PID: 5885, Parent: 5875, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 ggtq

yakuza.ppc.elf New Fork (PID: 5886, Parent: 5529)

sh (PID: 5886, Parent: 5529, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 1378bfp919GRB1Q2 || busybox pkill -9 1378bfp919GRB1Q2"

sh New Fork (PID: 5888, Parent: 5886)

pkill (PID: 5888, Parent: 5886, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 1378bfp919GRB1Q2

sh New Fork (PID: 5889, Parent: 5886)

busybox (PID: 5889, Parent: 5886, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 1378bfp919GRB1Q2

yakuza.ppc.elf New Fork (PID: 5890, Parent: 5529)

sh (PID: 5890, Parent: 5529, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 SAIAKUSO || busybox pkill -9 SAIAKUSO"

sh New Fork (PID: 5895, Parent: 5890)

pkill (PID: 5895, Parent: 5890, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 SAIAKUSO

sh New Fork (PID: 5898, Parent: 5890)

busybox (PID: 5898, Parent: 5890, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 SAIAKUSO

yakuza.ppc.elf New Fork (PID: 5899, Parent: 5529)

sh (PID: 5899, Parent: 5529, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 ggtr || busybox pkill -9 ggtr"

sh New Fork (PID: 5901, Parent: 5899)

pkill (PID: 5901, Parent: 5899, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 ggtr

sh New Fork (PID: 5902, Parent: 5899)

busybox (PID: 5902, Parent: 5899, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 ggtr

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
yakuza.ppc.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
yakuza.ppc.elf	Linux_Trojan_Tsunami_8a11f9be	unknown	unknown	0x17f99:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20 0x1864d:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20

Memory Dumps

Source	Rule	Description	Author	Strings
5527.1.00007f4f4c001000.00007f4f4c01c000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5527.1.00007f4f4c001000.00007f4f4c01c000.r-x.sdmp	Linux_Trojan_Tsunami_8a11f9be	unknown	unknown	0x17f99:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20 0x1864d:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20
Process Memory Space: yakuza.ppc.elf PID: 5527	Linux_Trojan_Tsunami_8a11f9be	unknown	unknown	0x54f0:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20 0x5601:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20 0x5c3e:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: yakuza.ppc.elf

ReversingLabs: Detection: 57%

Source: /usr/bin/pkill (PID: 5541)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5550)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5557)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5566)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5570)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5576)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5584)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5590)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5616)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5622)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5626)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5637)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5644)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5653)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5659)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5669)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5673)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5679)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5689)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5696)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5707)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5714)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5718)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5729)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5733)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5739)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5746)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5752)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5756)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5762)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5766)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5772)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5780)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5786)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5794)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5803)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5808)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5814)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5821)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5827)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5831)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5841)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5845)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5849)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5858)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5864)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5873)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5881)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5888)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5895)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5901)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Networking

Uses IRC for communication with a C&C

Source: unknown

IRC traffic detected: 192.168.2.15:50306 -> 95.234.158.87:6780 NICK [OSX|POWERPC]LOwa USER LOwa localhost localhost :LOwa

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: IRC traffic on port 50306 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 50308 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 50310 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 50312 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 50314 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 50316 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 50318 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 50320 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 50322 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 50324 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 50326 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 50328 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 50330 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 50332 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 50334 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 50336 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 50338 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 50338 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 50338 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 50338 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 50338 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 50340 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 50342 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 50344 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 50346 -> 6780

Source: global traffic

TCP traffic: 192.168.2.15:50306 -> 95.234.158.87:6780

Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87

Source: yakuza.ppc.elf	String found in binary or memory: http://linux-it.abuser.eu/yak.sh;
Source: yakuza.ppc.elf	String found in binary or memory: https://youtu.be/dQw4w9WgXcQ
Source: yakuza.ppc.elf	String found in binary or memory: https://youtu.be/dQw4w9WgXcQNever

System Summary

Malicious sample detected (through community Yara rule)

Source: yakuza.ppc.elf, type: SAMPLE	Matched rule: Linux_Trojan_Tsunami_8a11f9be Author: unknown
Source: 5527.1.00007f4f4c001000.00007f4f4c01c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_8a11f9be Author: unknown
Source: Process Memory Space: yakuza.ppc.elf PID: 5527, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_8a11f9be Author: unknown

Source: yakuza.ppc.elf	ELF static info symbol of initial sample: passwords
Source: yakuza.ppc.elf	ELF static info symbol of initial sample: usernames

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: pkill -9 %s \|\| busybox pkill -9 %s
Source: Initial sample	String containing 'busybox' found: pkill -9 %s \|\| busybox pkill -9 %shistory -c;history -wcd /root;rm -f .bash_historycd /var/tmp; rm -f *NOTICE %s :MOVE <server>

Source: Initial sample	String containing potential weak password found: guest
Source: Initial sample	String containing potential weak password found: default
Source: Initial sample	String containing potential weak password found: admin
Source: Initial sample	String containing potential weak password found: supervisor
Source: Initial sample	String containing potential weak password found: service
Source: Initial sample	String containing potential weak password found: administrator
Source: Initial sample	String containing potential weak password found: support
Source: Initial sample	String containing potential weak password found: 123456
Source: Initial sample	String containing potential weak password found: password
Source: Initial sample	String containing potential weak password found: 12345

Source: yakuza.ppc.elf, type: SAMPLE	Matched rule: Linux_Trojan_Tsunami_8a11f9be reference_sample = 1f773d0e00d40eecde9e3ab80438698923a2620036c2fc33315ef95229e98571, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = 91e2572a3bb8583e20042578e95e1746501c6a71ef7635af2c982a05b18d7c6d, id = 8a11f9be-dc85-4695-9f38-80ca0304780e, last_modified = 2021-09-16
Source: 5527.1.00007f4f4c001000.00007f4f4c01c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_8a11f9be reference_sample = 1f773d0e00d40eecde9e3ab80438698923a2620036c2fc33315ef95229e98571, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = 91e2572a3bb8583e20042578e95e1746501c6a71ef7635af2c982a05b18d7c6d, id = 8a11f9be-dc85-4695-9f38-80ca0304780e, last_modified = 2021-09-16
Source: Process Memory Space: yakuza.ppc.elf PID: 5527, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_8a11f9be reference_sample = 1f773d0e00d40eecde9e3ab80438698923a2620036c2fc33315ef95229e98571, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = 91e2572a3bb8583e20042578e95e1746501c6a71ef7635af2c982a05b18d7c6d, id = 8a11f9be-dc85-4695-9f38-80ca0304780e, last_modified = 2021-09-16

Source: classification engine

Classification label: mal72.troj.linELF@0/0@0/0

Source: yakuza.ppc.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/powerpc/brk.S
Source: yakuza.ppc.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/powerpc/crt1.S
Source: yakuza.ppc.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/powerpc/crti.S
Source: yakuza.ppc.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/powerpc/crtn.S
Source: yakuza.ppc.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/powerpc/vfork.S

Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/110/status
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/110/cmdline
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/231/status
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/231/cmdline
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/111/status
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/111/cmdline
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/112/status
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/112/cmdline
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/233/status
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/233/cmdline
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/113/status
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/113/cmdline
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/114/status
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/114/cmdline
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/235/status
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/235/cmdline
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/115/status
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/115/cmdline
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/1333/status
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/1333/cmdline
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/116/status
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/116/cmdline
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/1695/status
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/1695/cmdline
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/117/status
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/117/cmdline
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/118/status
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/118/cmdline
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/119/status
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/119/cmdline
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/911/status
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/911/cmdline
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/914/status
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/914/cmdline
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/10/status
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/10/cmdline
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/917/status
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/917/cmdline
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/11/status
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/11/cmdline
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/12/status
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/12/cmdline
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/13/status
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/13/cmdline
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/14/status
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/14/cmdline
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/15/status
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/15/cmdline
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/16/status
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/16/cmdline
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/17/status
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/17/cmdline
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/18/status
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/18/cmdline
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/19/status
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/19/cmdline
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/1591/status
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/1591/cmdline
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/120/status
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/120/cmdline
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/121/status
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/121/cmdline
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/1/status
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/1/cmdline
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/122/status
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/122/cmdline
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/243/status
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/243/cmdline
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/2/status
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/2/cmdline
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/123/status
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/123/cmdline
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/3/status
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/3/cmdline
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/124/status
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/124/cmdline
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/1588/status
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/1588/cmdline
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/125/status
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/125/cmdline
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/4/status
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/4/cmdline
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/246/status
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/246/cmdline
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/126/status
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/126/cmdline
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/5/status
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/5/cmdline
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/127/status
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/127/cmdline
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/6/status
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/6/cmdline
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/1585/status
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/1585/cmdline
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/128/status
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/128/cmdline
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/7/status
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/7/cmdline
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/129/status
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/129/cmdline
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/8/status
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/8/cmdline
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/800/status
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/800/cmdline
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/9/status
Source: /usr/bin/pkill (PID: 5780)	File opened: /proc/9/cmdline

Source: /tmp/yakuza.ppc.elf (PID: 5535)	Shell command executed: sh -c "pkill -9 902i13 \|\| busybox pkill -9 902i13"	Jump to behavior
Source: /tmp/yakuza.ppc.elf (PID: 5545)	Shell command executed: sh -c "pkill -9 BzSxLxBxeY \|\| busybox pkill -9 BzSxLxBxeY"	Jump to behavior
Source: /tmp/yakuza.ppc.elf (PID: 5552)	Shell command executed: sh -c "pkill -9 HOHO-LUGO7 \|\| busybox pkill -9 HOHO-LUGO7"	Jump to behavior
Source: /tmp/yakuza.ppc.elf (PID: 5561)	Shell command executed: sh -c "pkill -9 HOHO-U79OL \|\| busybox pkill -9 HOHO-U79OL"	Jump to behavior
Source: /tmp/yakuza.ppc.elf (PID: 5568)	Shell command executed: sh -c "pkill -9 JuYfouyf87 \|\| busybox pkill -9 JuYfouyf87"	Jump to behavior
Source: /tmp/yakuza.ppc.elf (PID: 5574)	Shell command executed: sh -c "pkill -9 NiGGeR69xd \|\| busybox pkill -9 NiGGeR69xd"	Jump to behavior
Source: /tmp/yakuza.ppc.elf (PID: 5578)	Shell command executed: sh -c "pkill -9 SO190Ij1X \|\| busybox pkill -9 SO190Ij1X"	Jump to behavior
Source: /tmp/yakuza.ppc.elf (PID: 5588)	Shell command executed: sh -c "pkill -9 LOLKIKEEEDDE \|\| busybox pkill -9 LOLKIKEEEDDE"	Jump to behavior
Source: /tmp/yakuza.ppc.elf (PID: 5611)	Shell command executed: sh -c "pkill -9 ekjheory98e \|\| busybox pkill -9 ekjheory98e"	Jump to behavior
Source: /tmp/yakuza.ppc.elf (PID: 5620)	Shell command executed: sh -c "pkill -9 scansh4 \|\| busybox pkill -9 scansh4"	Jump to behavior
Source: /tmp/yakuza.ppc.elf (PID: 5624)	Shell command executed: sh -c "pkill -9 MDMA \|\| busybox pkill -9 MDMA"	Jump to behavior
Source: /tmp/yakuza.ppc.elf (PID: 5631)	Shell command executed: sh -c "pkill -9 fdevalvex \|\| busybox pkill -9 fdevalvex"	Jump to behavior
Source: /tmp/yakuza.ppc.elf (PID: 5639)	Shell command executed: sh -c "pkill -9 scanspc \|\| busybox pkill -9 scanspc"	Jump to behavior
Source: /tmp/yakuza.ppc.elf (PID: 5648)	Shell command executed: sh -c "pkill -9 MELTEDNINJAREALZ \|\| busybox pkill -9 MELTEDNINJAREALZ"	Jump to behavior
Source: /tmp/yakuza.ppc.elf (PID: 5655)	Shell command executed: sh -c "pkill -9 flexsonskids \|\| busybox pkill -9 flexsonskids"	Jump to behavior
Source: /tmp/yakuza.ppc.elf (PID: 5664)	Shell command executed: sh -c "pkill -9 scanx86 \|\| busybox pkill -9 scanx86"
Source: /tmp/yakuza.ppc.elf (PID: 5671)	Shell command executed: sh -c "pkill -9 MISAKI-U79OL \|\| busybox pkill -9 MISAKI-U79OL"
Source: /tmp/yakuza.ppc.elf (PID: 5677)	Shell command executed: sh -c "pkill -9 foAxi102kxe \|\| busybox pkill -9 foAxi102kxe"
Source: /tmp/yakuza.ppc.elf (PID: 5681)	Shell command executed: sh -c "pkill -9 swodjwodjwoj \|\| busybox pkill -9 swodjwodjwoj"
Source: /tmp/yakuza.ppc.elf (PID: 5691)	Shell command executed: sh -c "pkill -9 MmKiy7f87l \|\| busybox pkill -9 MmKiy7f87l"
Source: /tmp/yakuza.ppc.elf (PID: 5700)	Shell command executed: sh -c "pkill -9 freecookiex86 \|\| busybox pkill -9 freecookiex86"
Source: /tmp/yakuza.ppc.elf (PID: 5709)	Shell command executed: sh -c "pkill -9 sysgpu \|\| busybox pkill -9 sysgpu"
Source: /tmp/yakuza.ppc.elf (PID: 5716)	Shell command executed: sh -c "pkill -9 NiGGeR69xd \|\| busybox pkill -9 NiGGeR69xd"
Source: /tmp/yakuza.ppc.elf (PID: 5723)	Shell command executed: sh -c "pkill -9 frgege \|\| busybox pkill -9 frgege"
Source: /tmp/yakuza.ppc.elf (PID: 5731)	Shell command executed: sh -c "pkill -9 sysupdater \|\| busybox pkill -9 sysupdater"
Source: /tmp/yakuza.ppc.elf (PID: 5737)	Shell command executed: sh -c "pkill -9 0DnAzepd \|\| busybox pkill -9 0DnAzepd"
Source: /tmp/yakuza.ppc.elf (PID: 5741)	Shell command executed: sh -c "pkill -9 NiGGeRD0nks69 \|\| busybox pkill -9 NiGGeRD0nks69"
Source: /tmp/yakuza.ppc.elf (PID: 5750)	Shell command executed: sh -c "pkill -9 frgreu \|\| busybox pkill -9 frgreu"
Source: /tmp/yakuza.ppc.elf (PID: 5754)	Shell command executed: sh -c "pkill -9 telnetd \|\| busybox pkill -9 telnetd"
Source: /tmp/yakuza.ppc.elf (PID: 5760)	Shell command executed: sh -c "pkill -9 0x766f6964 \|\| busybox pkill -9 0x766f6964"
Source: /tmp/yakuza.ppc.elf (PID: 5764)	Shell command executed: sh -c "pkill -9 NiGGeRd0nks1337 \|\| busybox pkill -9 NiGGeRd0nks1337"
Source: /tmp/yakuza.ppc.elf (PID: 5770)	Shell command executed: sh -c "pkill -9 gaft \|\| busybox pkill -9 gaft"
Source: /tmp/yakuza.ppc.elf (PID: 5774)	Shell command executed: sh -c "pkill -9 urasgbsigboa \|\| busybox pkill -9 urasgbsigboa"
Source: /tmp/yakuza.ppc.elf (PID: 5784)	Shell command executed: sh -c "pkill -9 120i3UI49 \|\| busybox pkill -9 120i3UI49"
Source: /tmp/yakuza.ppc.elf (PID: 5788)	Shell command executed: sh -c "pkill -9 OaF3 \|\| busybox pkill -9 OaF3"
Source: /tmp/yakuza.ppc.elf (PID: 5799)	Shell command executed: sh -c "pkill -9 geae \|\| busybox pkill -9 geae"
Source: /tmp/yakuza.ppc.elf (PID: 5806)	Shell command executed: sh -c "pkill -9 vaiolmao \|\| busybox pkill -9 vaiolmao"
Source: /tmp/yakuza.ppc.elf (PID: 5812)	Shell command executed: sh -c "pkill -9 123123a \|\| busybox pkill -9 123123a"
Source: /tmp/yakuza.ppc.elf (PID: 5816)	Shell command executed: sh -c "pkill -9 Ofurain0n4H34D \|\| busybox pkill -9 Ofurain0n4H34D"
Source: /tmp/yakuza.ppc.elf (PID: 5825)	Shell command executed: sh -c "pkill -9 ggTrex \|\| busybox pkill -9 ggTrex"
Source: /tmp/yakuza.ppc.elf (PID: 5829)	Shell command executed: sh -c "pkill -9 wasads \|\| busybox pkill -9 wasads"
Source: /tmp/yakuza.ppc.elf (PID: 5835)	Shell command executed: sh -c "pkill -9 1293194hjXD \|\| busybox pkill -9 1293194hjXD"
Source: /tmp/yakuza.ppc.elf (PID: 5843)	Shell command executed: sh -c "pkill -9 OthLaLosn \|\| busybox pkill -9 OthLaLosn"
Source: /tmp/yakuza.ppc.elf (PID: 5847)	Shell command executed: sh -c "pkill -9 ggt \|\| busybox pkill -9 ggt"
Source: /tmp/yakuza.ppc.elf (PID: 5853)	Shell command executed: sh -c "pkill -9 wget-log \|\| busybox pkill -9 wget-log"
Source: /tmp/yakuza.ppc.elf (PID: 5862)	Shell command executed: sh -c "pkill -9 1337SoraLOADER \|\| busybox pkill -9 1337SoraLOADER"
Source: /tmp/yakuza.ppc.elf (PID: 5868)	Shell command executed: sh -c "pkill -9 SAIAKINA \|\| busybox pkill -9 SAIAKINA"
Source: /tmp/yakuza.ppc.elf (PID: 5875)	Shell command executed: sh -c "pkill -9 ggtq \|\| busybox pkill -9 ggtq"
Source: /tmp/yakuza.ppc.elf (PID: 5886)	Shell command executed: sh -c "pkill -9 1378bfp919GRB1Q2 \|\| busybox pkill -9 1378bfp919GRB1Q2"
Source: /tmp/yakuza.ppc.elf (PID: 5890)	Shell command executed: sh -c "pkill -9 SAIAKUSO \|\| busybox pkill -9 SAIAKUSO"
Source: /tmp/yakuza.ppc.elf (PID: 5899)	Shell command executed: sh -c "pkill -9 ggtr \|\| busybox pkill -9 ggtr"

Source: /bin/sh (PID: 5541)	Pkill executable: /usr/bin/pkill -> pkill -9 902i13	Jump to behavior
Source: /bin/sh (PID: 5550)	Pkill executable: /usr/bin/pkill -> pkill -9 BzSxLxBxeY	Jump to behavior
Source: /bin/sh (PID: 5557)	Pkill executable: /usr/bin/pkill -> pkill -9 HOHO-LUGO7	Jump to behavior
Source: /bin/sh (PID: 5566)	Pkill executable: /usr/bin/pkill -> pkill -9 HOHO-U79OL	Jump to behavior
Source: /bin/sh (PID: 5570)	Pkill executable: /usr/bin/pkill -> pkill -9 JuYfouyf87	Jump to behavior
Source: /bin/sh (PID: 5576)	Pkill executable: /usr/bin/pkill -> pkill -9 NiGGeR69xd	Jump to behavior
Source: /bin/sh (PID: 5584)	Pkill executable: /usr/bin/pkill -> pkill -9 SO190Ij1X	Jump to behavior
Source: /bin/sh (PID: 5590)	Pkill executable: /usr/bin/pkill -> pkill -9 LOLKIKEEEDDE	Jump to behavior
Source: /bin/sh (PID: 5616)	Pkill executable: /usr/bin/pkill -> pkill -9 ekjheory98e	Jump to behavior
Source: /bin/sh (PID: 5622)	Pkill executable: /usr/bin/pkill -> pkill -9 scansh4	Jump to behavior
Source: /bin/sh (PID: 5626)	Pkill executable: /usr/bin/pkill -> pkill -9 MDMA	Jump to behavior
Source: /bin/sh (PID: 5637)	Pkill executable: /usr/bin/pkill -> pkill -9 fdevalvex	Jump to behavior
Source: /bin/sh (PID: 5644)	Pkill executable: /usr/bin/pkill -> pkill -9 scanspc	Jump to behavior
Source: /bin/sh (PID: 5653)	Pkill executable: /usr/bin/pkill -> pkill -9 MELTEDNINJAREALZ	Jump to behavior
Source: /bin/sh (PID: 5659)	Pkill executable: /usr/bin/pkill -> pkill -9 flexsonskids	Jump to behavior
Source: /bin/sh (PID: 5669)	Pkill executable: /usr/bin/pkill -> pkill -9 scanx86
Source: /bin/sh (PID: 5673)	Pkill executable: /usr/bin/pkill -> pkill -9 MISAKI-U79OL
Source: /bin/sh (PID: 5679)	Pkill executable: /usr/bin/pkill -> pkill -9 foAxi102kxe
Source: /bin/sh (PID: 5689)	Pkill executable: /usr/bin/pkill -> pkill -9 swodjwodjwoj
Source: /bin/sh (PID: 5696)	Pkill executable: /usr/bin/pkill -> pkill -9 MmKiy7f87l
Source: /bin/sh (PID: 5707)	Pkill executable: /usr/bin/pkill -> pkill -9 freecookiex86
Source: /bin/sh (PID: 5714)	Pkill executable: /usr/bin/pkill -> pkill -9 sysgpu
Source: /bin/sh (PID: 5718)	Pkill executable: /usr/bin/pkill -> pkill -9 NiGGeR69xd
Source: /bin/sh (PID: 5729)	Pkill executable: /usr/bin/pkill -> pkill -9 frgege
Source: /bin/sh (PID: 5733)	Pkill executable: /usr/bin/pkill -> pkill -9 sysupdater
Source: /bin/sh (PID: 5739)	Pkill executable: /usr/bin/pkill -> pkill -9 0DnAzepd
Source: /bin/sh (PID: 5746)	Pkill executable: /usr/bin/pkill -> pkill -9 NiGGeRD0nks69
Source: /bin/sh (PID: 5752)	Pkill executable: /usr/bin/pkill -> pkill -9 frgreu
Source: /bin/sh (PID: 5756)	Pkill executable: /usr/bin/pkill -> pkill -9 telnetd
Source: /bin/sh (PID: 5762)	Pkill executable: /usr/bin/pkill -> pkill -9 0x766f6964
Source: /bin/sh (PID: 5766)	Pkill executable: /usr/bin/pkill -> pkill -9 NiGGeRd0nks1337
Source: /bin/sh (PID: 5772)	Pkill executable: /usr/bin/pkill -> pkill -9 gaft
Source: /bin/sh (PID: 5780)	Pkill executable: /usr/bin/pkill -> pkill -9 urasgbsigboa
Source: /bin/sh (PID: 5786)	Pkill executable: /usr/bin/pkill -> pkill -9 120i3UI49
Source: /bin/sh (PID: 5794)	Pkill executable: /usr/bin/pkill -> pkill -9 OaF3
Source: /bin/sh (PID: 5803)	Pkill executable: /usr/bin/pkill -> pkill -9 geae
Source: /bin/sh (PID: 5808)	Pkill executable: /usr/bin/pkill -> pkill -9 vaiolmao
Source: /bin/sh (PID: 5814)	Pkill executable: /usr/bin/pkill -> pkill -9 123123a
Source: /bin/sh (PID: 5821)	Pkill executable: /usr/bin/pkill -> pkill -9 Ofurain0n4H34D
Source: /bin/sh (PID: 5827)	Pkill executable: /usr/bin/pkill -> pkill -9 ggTrex
Source: /bin/sh (PID: 5831)	Pkill executable: /usr/bin/pkill -> pkill -9 wasads
Source: /bin/sh (PID: 5841)	Pkill executable: /usr/bin/pkill -> pkill -9 1293194hjXD
Source: /bin/sh (PID: 5845)	Pkill executable: /usr/bin/pkill -> pkill -9 OthLaLosn
Source: /bin/sh (PID: 5849)	Pkill executable: /usr/bin/pkill -> pkill -9 ggt
Source: /bin/sh (PID: 5858)	Pkill executable: /usr/bin/pkill -> pkill -9 wget-log
Source: /bin/sh (PID: 5864)	Pkill executable: /usr/bin/pkill -> pkill -9 1337SoraLOADER
Source: /bin/sh (PID: 5873)	Pkill executable: /usr/bin/pkill -> pkill -9 SAIAKINA
Source: /bin/sh (PID: 5881)	Pkill executable: /usr/bin/pkill -> pkill -9 ggtq
Source: /bin/sh (PID: 5888)	Pkill executable: /usr/bin/pkill -> pkill -9 1378bfp919GRB1Q2
Source: /bin/sh (PID: 5895)	Pkill executable: /usr/bin/pkill -> pkill -9 SAIAKUSO
Source: /bin/sh (PID: 5901)	Pkill executable: /usr/bin/pkill -> pkill -9 ggtr

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: IRC traffic on port 50306 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 50308 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 50310 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 50312 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 50314 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 50316 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 50318 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 50320 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 50322 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 50324 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 50326 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 50328 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 50330 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 50332 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 50334 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 50336 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 50338 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 50338 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 50338 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 50338 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 50338 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 50340 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 50342 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 50344 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 50346 -> 6780

Source: /usr/bin/pkill (PID: 5541)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5550)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5557)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5566)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5570)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5576)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5584)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5590)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5616)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5622)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5626)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5637)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5644)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5653)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5659)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5669)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5673)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5679)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5689)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5696)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5707)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5714)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5718)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5729)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5733)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5739)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5746)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5752)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5756)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5762)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5766)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5772)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5780)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5786)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5794)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5803)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5808)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5814)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5821)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5827)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5831)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5841)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5845)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5849)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5858)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5864)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5873)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5881)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5888)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5895)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5901)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Source: /tmp/yakuza.ppc.elf (PID: 5527)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5542)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5551)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5560)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5567)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5573)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5577)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5587)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5610)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5619)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5623)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5630)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5638)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5647)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5654)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5663)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5670)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5676)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5680)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5690)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5699)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5708)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5715)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5722)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5730)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5736)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5740)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5749)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5753)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5759)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5763)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5769)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5773)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5783)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5787)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5798)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5805)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5809)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5815)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5822)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5828)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5832)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5842)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5846)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5852)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5861)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5867)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5874)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5885)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5889)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5898)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5902)	Queries kernel information via 'uname':

Source: yakuza.ppc.elf, 5527.1.000056276488d000.000056276493d000.rw-.sdmp	Binary or memory string: !/etc/qemu-binfmt/ppc11!hotpluggableq
Source: yakuza.ppc.elf, 5527.1.000056276488d000.000056276493d000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/ppc
Source: yakuza.ppc.elf, 5527.1.00007ffd37094000.00007ffd370b5000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-ppc
Source: yakuza.ppc.elf, 5527.1.00007ffd37094000.00007ffd370b5000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-ppc/tmp/yakuza.ppc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/yakuza.ppc.elf

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: yakuza.ppc.elf, type: SAMPLE
Source: Yara match	File source: 5527.1.00007f4f4c001000.00007f4f4c01c000.r-x.sdmp, type: MEMORY

Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:48.0) Gecko/20100101 Firefox/48.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en; rv:1.8.1.11) Gecko/20071128 Camino/1.5.4
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; rv:2.2) Gecko/20110201
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; cs; rv:1.9.2.6) Gecko/20100628 myibrow/4alpha2
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Win 9x 4.90; SG; rv:1.9.2.4) Gecko/20101104 Netscape/9.1.0285
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.2.0 Lightning/4.0.2
Source: Initial sample	User agent string found: Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U;) Presto/2.7.62 Version/11.01
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; Linux x86_64; U; de; rv:1.9.1.6) Gecko/20091201 Firefox/3.5.6 Opera 10.62
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Linux; Android 4.4.3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.89 Mobile Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0) Gecko/20110517 Firefox/5.0 Fennec/5.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Android; Linux armv7l; rv:9.0) Gecko/20111216 Firefox/9.0 Fennec/9.0
Source: Initial sample	User agent string found: Mozilla/5.0 (compatible; Teleca Q7; Brew 3.1.5; U; en) 480X800 LGE VX11000

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: yakuza.ppc.elf, type: SAMPLE
Source: Yara match	File source: 5527.1.00007f4f4c001000.00007f4f4c01c000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 Masquerading	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	1 Brute Force	1 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
yakuza.ppc.elf	58%	ReversingLabs	Linux.Trojan.Tsunami

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://youtu.be/dQw4w9WgXcQ	yakuza.ppc.elf	false	high
http://linux-it.abuser.eu/yak.sh;	yakuza.ppc.elf	false	unknown
https://youtu.be/dQw4w9WgXcQNever	yakuza.ppc.elf	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
95.234.158.87	unknown	Italy		3269	ASN-IBSNAZIT	true

Joe Sandbox View / Context

IPs

⊘No context

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ASN-IBSNAZIT	sparc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	131.1.112.117
	sh4.elf	Get hash	malicious	Mirai, Moobot	Browse	79.16.25.108
	mpsl.elf	Get hash	malicious	Mirai, Moobot	Browse	95.224.165.124
	powerpc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	79.58.184.246
	mips.elf	Get hash	malicious	Mirai, Moobot	Browse	79.39.13.191
	arm.elf	Get hash	malicious	Mirai, Moobot	Browse	2.114.140.56
	m68k.elf	Get hash	malicious	Mirai, Moobot	Browse	87.16.92.237
	arm7.elf	Get hash	malicious	Mirai, Moobot	Browse	95.235.74.87
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	80.181.217.0
	mipsel.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	79.62.54.196

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit MSB executable, PowerPC or cisco 4500, version 1 (SYSV), statically linked, not stripped
Entropy (8bit):	6.185572616656928
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	yakuza.ppc.elf
File size:	143'381 bytes
MD5:	79634876f190036b8b502b18ec19091d
SHA1:	ec5522c01efaede1145fe409c27446e900c48d70
SHA256:	b6fa1de9fec1861ce91022f270fa05bada43174ea8b35aca238e330ead60c0b8
SHA512:	de3fc62b800f0ac144da2c910ba592fd9a62f0186b8a194045fb21f08b5452cc6656c677de082fd2e03799c6073761a332884883cf03e311e42da40f053dea09
SSDEEP:	3072:U+ReIrBUY6pjjhLkmXoyYurYqtW19nvvWnDf4urTpzI:UGeIrWYofhA8rYqInvvWnDf4urTpzI
TLSH:	B2E35B9B6B0D1767C1BB1AF12DB727F087ADFA61016621C4A40DFFC01372A70661AF99
File Content Preview:	.ELF...........................4...h.....4. ...(.......................T...T........................................dt.Q.............................!..\|......$H...H.U....$8!. \|...N.. .!..\|.......?..........P..../...@..\?........+../...A..$8...})......N..

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	PowerPC
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x100001f0
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	117608
Section Header Size:	40
Number of Section Headers:	17
Header String Table Index:	14

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x10000094	0x94	0x24	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x100000b8	0xb8	0x15654	0x0	0x6	AX	0	0	4
.fini	PROGBITS	0x1001570c	0x1570c	0x20	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x10015730	0x15730	0x5820	0x0	0x2	A	0	0	8
.eh_frame	PROGBITS	0x1001af50	0x1af50	0x4	0x0	0x2	A	0	0	4
.ctors	PROGBITS	0x1002b000	0x1b000	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x1002b008	0x1b008	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x1002b010	0x1b010	0x4	0x0	0x3	WA	0	0	4
.data	PROGBITS	0x1002b018	0x1b018	0xd18	0x0	0x3	WA	0	0	8
.sdata	PROGBITS	0x1002bd30	0x1bd30	0x68	0x0	0x3	WA	0	0	4
.sbss	NOBITS	0x1002bd98	0x1bd98	0xb8	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x1002be50	0x1bd98	0x7738	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x1bd98	0xd5c	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x1caf4	0x73	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x1ce10	0x3870	0x10	0x0		16	301	4
.strtab	STRTAB	0x0	0x20680	0x2995	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x10000000	0x10000000	0x1af54	0x1af54	6.2406	0x5	R E	0x10000	.init .text .fini .rodata .eh_frame
LOAD	0x1b000	0x1002b000	0x1002b000	0xd98	0x8588	4.5434	0x6	RW	0x10000	.ctors .dtors .jcr .data .sdata .sbss .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x10000094	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x100000b8	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x1001570c	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x10015730	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x1001af50	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x1002b000	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x1002b008	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x1002b010	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x1002b018	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x1002bd30	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x1002bd98	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x1002be50	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
C.71.5596	.symtab	0x100175f8	36	OBJECT	<unknown>	DEFAULT	4
C.89.5815	.symtab	0x10017c70	312	OBJECT	<unknown>	DEFAULT	4
C.96.5912	.symtab	0x10017e1c	12	OBJECT	<unknown>	DEFAULT	4
ClearHistory	.symtab	0x1000790c	80	FUNC	<unknown>	DEFAULT	2
HTTP	.symtab	0x10002dc4	396	FUNC	<unknown>	DEFAULT	2
Q	.symtab	0x1002c26c	16384	OBJECT	<unknown>	DEFAULT	12
Send	.symtab	0x10000530	212	FUNC	<unknown>	DEFAULT	2
UserAgents	.symtab	0x1002b338	144	OBJECT	<unknown>	DEFAULT	9
_352	.symtab	0x10009238	40	FUNC	<unknown>	DEFAULT	2
_376	.symtab	0x1000912c	188	FUNC	<unknown>	DEFAULT	2
_433	.symtab	0x10009260	108	FUNC	<unknown>	DEFAULT	2
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_NICK	.symtab	0x100092cc	300	FUNC	<unknown>	DEFAULT	2
_PING	.symtab	0x100091e8	80	FUNC	<unknown>	DEFAULT	2
_PRIVMSG	.symtab	0x100084e0	3148	FUNC	<unknown>	DEFAULT	2
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_SDA_BASE_	.symtab	0x10033d30	0	NOTYPE	<unknown>	DEFAULT	10
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x1002b004	0	OBJECT	<unknown>	DEFAULT	6
__CTOR_LIST__	.symtab	0x1002b000	0	OBJECT	<unknown>	DEFAULT	6
__C_ctype_b	.symtab	0x1002bd88	4	OBJECT	<unknown>	DEFAULT	10
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x1001a836	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x1002bd90	4	OBJECT	<unknown>	DEFAULT	10
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x1001ab36	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x1002bd5c	4	OBJECT	<unknown>	DEFAULT	10
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x100195a8	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x1002b00c	0	OBJECT	<unknown>	DEFAULT	7
__DTOR_LIST__	.symtab	0x1002b008	0	OBJECT	<unknown>	DEFAULT	7
__EH_FRAME_BEGIN__	.symtab	0x1001af50	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x1001af50	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x1002bd88	4	OBJECT	<unknown>	HIDDEN	10
__GI___C_ctype_b_data	.symtab	0x1001a836	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_tolower	.symtab	0x1002bd90	4	OBJECT	<unknown>	HIDDEN	10
__GI___C_ctype_tolower_data	.symtab	0x1001ab36	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_toupper	.symtab	0x1002bd5c	4	OBJECT	<unknown>	HIDDEN	10
__GI___C_ctype_toupper_data	.symtab	0x100195a8	768	OBJECT	<unknown>	HIDDEN	4
__GI___ctype_b	.symtab	0x1002bd8c	4	OBJECT	<unknown>	HIDDEN	10
__GI___ctype_tolower	.symtab	0x1002bd94	4	OBJECT	<unknown>	HIDDEN	10
__GI___ctype_toupper	.symtab	0x1002bd60	4	OBJECT	<unknown>	HIDDEN	10
__GI___errno_location	.symtab	0x1000aa10	12	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x1001235c	312	FUNC	<unknown>	HIDDEN	2
__GI___fputc_unlocked	.symtab	0x1000cde4	292	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x1000d4d8	48	FUNC	<unknown>	HIDDEN	2
__GI___h_errno_location	.symtab	0x100115f8	12	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x1000a404	132	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl64	.symtab	0x1000a488	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x100113d8	120	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x10010d18	148	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x10010e18	128	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x1000d508	268	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x1001115c	60	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x1001454c	336	FUNC	<unknown>	HIDDEN	2
__GI_accept	.symtab	0x1000f6f4	52	FUNC	<unknown>	HIDDEN	2
__GI_asprintf	.symtab	0x1000acf0	128	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x100105e0	12	FUNC	<unknown>	HIDDEN	2
__GI_atol	.symtab	0x100105e0	12	FUNC	<unknown>	HIDDEN	2
__GI_bind	.symtab	0x1000f728	52	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x100146ec	52	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0x1000a4ec	72	FUNC	<unknown>	HIDDEN	2
__GI_clock_getres	.symtab	0x10011198	72	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x1000a534	72	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x1000f75c	52	FUNC	<unknown>	HIDDEN	2
__GI_dup2	.symtab	0x100111e0	72	FUNC	<unknown>	HIDDEN	2
__GI_endservent	.symtab	0x10012c10	128	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x1002be20	4	OBJECT	<unknown>	HIDDEN	11
__GI_execl	.symtab	0x10010834	308	FUNC	<unknown>	HIDDEN	2
__GI_execve	.symtab	0x10011228	72	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x100107b0	132	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x1000aa1c	332	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x1000a404	132	FUNC	<unknown>	HIDDEN	2
__GI_fcntl64	.symtab	0x1000a488	100	FUNC	<unknown>	HIDDEN	2
__GI_fdopen	.symtab	0x1001173c	100	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x1000cb70	432	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x1001235c	312	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x1000c864	148	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x1000cd20	196	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x1000ab68	12	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x1000a57c	72	FUNC	<unknown>	HIDDEN	2
__GI_fprintf	.symtab	0x1000ac70	128	FUNC	<unknown>	HIDDEN	2
__GI_fputc	.symtab	0x1000c8f8	204	FUNC	<unknown>	HIDDEN	2
__GI_fputs	.symtab	0x1000c9c4	140	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x1000cf08	92	FUNC	<unknown>	HIDDEN	2
__GI_freeaddrinfo	.symtab	0x1000e5dc	64	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x10014768	16	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x10014808	284	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x1000cf64	184	FUNC	<unknown>	HIDDEN	2
__GI_getaddrinfo	.symtab	0x1000e61c	756	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x1001235c	312	FUNC	<unknown>	HIDDEN	2
__GI_getcwd	.symtab	0x1000a5c4	256	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x1000a6c4	56	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x10011270	72	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x100112b8	72	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x10011300	72	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyaddr_r	.symtab	0x1000f3bc	824	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2_r	.symtab	0x1000f0e4	728	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x10013f90	836	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x1000a6fc	28	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x1000a718	72	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x1000a7a8	72	FUNC	<unknown>	HIDDEN	2
__GI_getservbyname_r	.symtab	0x10012e6c	284	FUNC	<unknown>	HIDDEN	2
__GI_getservbyport	.symtab	0x10012e14	88	FUNC	<unknown>	HIDDEN	2
__GI_getservbyport_r	.symtab	0x10012d30	228	FUNC	<unknown>	HIDDEN	2
__GI_getservent_r	.symtab	0x10012990	576	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x10011348	72	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x1002be24	4	OBJECT	<unknown>	HIDDEN	11
__GI_if_freenameindex	.symtab	0x10013310	88	FUNC	<unknown>	HIDDEN	2
__GI_if_nameindex	.symtab	0x10013134	476	FUNC	<unknown>	HIDDEN	2
__GI_if_nametoindex	.symtab	0x1001308c	168	FUNC	<unknown>	HIDDEN	2
__GI_in6addr_loopback	.symtab	0x1001a56c	16	OBJECT	<unknown>	HIDDEN	4
__GI_inet_addr	.symtab	0x1000f0b0	52	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x10013368	192	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa	.symtab	0x1000f07c	52	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa_r	.symtab	0x1000f000	124	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x1000ed5c	676	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x1000e9f0	524	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x100103a4	232	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x1000a31c	232	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x1000d734	44	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x1000a7f0	72	FUNC	<unknown>	HIDDEN	2
__GI_listen	.symtab	0x1000f7cc	48	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x100154c4	128	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x10012538	264	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x1000d01c	156	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x10012494	164	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x10012640	52	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x10012674	244	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x1000d0b8	144	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x10011390	72	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x100113d8	120	FUNC	<unknown>	HIDDEN	2
__GI_perror	.symtab	0x1000ab74	68	FUNC	<unknown>	HIDDEN	2
__GI_pipe	.symtab	0x10011460	72	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x1000a838	72	FUNC	<unknown>	HIDDEN	2
__GI_putc	.symtab	0x1000c8f8	204	FUNC	<unknown>	HIDDEN	2
__GI_putc_unlocked	.symtab	0x1000cde4	292	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x10015494	48	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x1000ff58	108	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x10010230	144	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x10014bd8	184	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x10015544	72	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x1000f7fc	56	FUNC	<unknown>	HIDDEN	2
__GI_rewind	.symtab	0x10014778	144	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x100114a8	112	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x1000a880	72	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x1000f834	56	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x1000f86c	64	FUNC	<unknown>	HIDDEN	2
__GI_setservent	.symtab	0x10012c90	160	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x1000a8c8	72	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x1000f8ac	60	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x1001013c	244	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x10014330	196	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x100143f4	224	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x10011518	120	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x10010968	468	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x1000f8e8	52	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x1000ad70	140	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x100102c0	228	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x1000d624	80	FUNC	<unknown>	HIDDEN	2
__GI_strcasestr	.symtab	0x1000d674	100	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x10012768	256	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x1000d148	52	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x1000d148	52	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x1000d17c	32	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x1000d6d8	80	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x1000d19c	164	FUNC	<unknown>	HIDDEN	2
__GI_strncat	.symtab	0x10014c90	208	FUNC	<unknown>	HIDDEN	2
__GI_strncmp	.symtab	0x1000d240	236	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x1000d32c	188	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x1000d3e8	240	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x10012908	60	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x10014d60	76	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x1000d728	12	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x10012868	160	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x100105ec	8	FUNC	<unknown>	HIDDEN	2
__GI_strtoul	.symtab	0x100105f4	8	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x10010b3c	400	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x1000d760	156	FUNC	<unknown>	HIDDEN	2
__GI_tcsetattr	.symtab	0x1000d7fc	356	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x1000a910	72	FUNC	<unknown>	HIDDEN	2
__GI_tolower	.symtab	0x100115d8	32	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x1000a9f0	32	FUNC	<unknown>	HIDDEN	2
__GI_vasprintf	.symtab	0x1000adfc	160	FUNC	<unknown>	HIDDEN	2
__GI_vfork	.symtab	0x10011104	16	FUNC	<unknown>	HIDDEN	2
__GI_vfprintf	.symtab	0x1000b6e8	176	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x1000ae9c	204	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x10011590	72	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x1000a9a0	8	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x10011604	92	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x10011670	204	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x10011660	16	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x1000a9a8	72	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x1002b010	0	OBJECT	<unknown>	DEFAULT	8
__JCR_LIST__	.symtab	0x1002b010	0	OBJECT	<unknown>	DEFAULT	8
__app_fini	.symtab	0x1002be14	4	OBJECT	<unknown>	HIDDEN	11
__atexit_lock	.symtab	0x1002bccc	24	OBJECT	<unknown>	DEFAULT	9
__bsd_signal	.symtab	0x100143f4	224	FUNC	<unknown>	HIDDEN	2
__bss_start	.symtab	0x1002bd98	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x10010db8	96	FUNC	<unknown>	DEFAULT	2
__ctype_b	.symtab	0x1002bd8c	4	OBJECT	<unknown>	DEFAULT	10
__ctype_tolower	.symtab	0x1002bd94	4	OBJECT	<unknown>	DEFAULT	10
__ctype_toupper	.symtab	0x1002bd60	4	OBJECT	<unknown>	DEFAULT	10
__curbrk	.symtab	0x1002be4c	4	OBJECT	<unknown>	DEFAULT	11
__data_start	.symtab	0x1002b020	0	NOTYPE	<unknown>	DEFAULT	9
__decode_answer	.symtab	0x10015004	272	FUNC	<unknown>	HIDDEN	2
__decode_dotted	.symtab	0x10013428	244	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x10014e98	196	FUNC	<unknown>	HIDDEN	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__dns_lookup	.symtab	0x1001351c	1692	FUNC	<unknown>	HIDDEN	2
__do_global_ctors_aux	.symtab	0x100156a0	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x100000b8	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x1002b018	0	OBJECT	<unknown>	HIDDEN	9
__encode_dotted	.symtab	0x1001558c	204	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x10014dac	236	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x10014f5c	124	FUNC	<unknown>	HIDDEN	2
__environ	.symtab	0x1002be0c	4	OBJECT	<unknown>	DEFAULT	11
__errno_location	.symtab	0x1000aa10	12	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x1002be04	4	OBJECT	<unknown>	HIDDEN	11
__fgetc_unlocked	.symtab	0x1001235c	312	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x1002b000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fini_array_start	.symtab	0x1002b000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fputc_unlocked	.symtab	0x1000cde4	292	FUNC	<unknown>	DEFAULT	2
__get_hosts_byaddr_r	.symtab	0x10013ee4	172	FUNC	<unknown>	HIDDEN	2
__get_hosts_byname_r	.symtab	0x10013e8c	88	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x1000a6fc	28	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x1000d4d8	48	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__h_errno_location	.symtab	0x100115f8	12	FUNC	<unknown>	DEFAULT	2
__h_errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__heap_alloc	.symtab	0x1000fca4	160	FUNC	<unknown>	DEFAULT	2
__heap_alloc_at	.symtab	0x1000fd44	156	FUNC	<unknown>	DEFAULT	2
__heap_free	.symtab	0x1000fe28	300	FUNC	<unknown>	DEFAULT	2
__heap_link_free_area	.symtab	0x1000fde0	44	FUNC	<unknown>	DEFAULT	2
__heap_link_free_area_after	.symtab	0x1000fe0c	28	FUNC	<unknown>	DEFAULT	2
__init_array_end	.symtab	0x1002b000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__init_array_start	.symtab	0x1002b000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__initbuf	.symtab	0x10012944	76	FUNC	<unknown>	DEFAULT	2
__length_dotted	.symtab	0x10015658	72	FUNC	<unknown>	HIDDEN	2
__length_question	.symtab	0x10014fd8	44	FUNC	<unknown>	HIDDEN	2
__libc_accept	.symtab	0x1000f6f4	52	FUNC	<unknown>	DEFAULT	2
__libc_close	.symtab	0x1000a534	72	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x1000f75c	52	FUNC	<unknown>	DEFAULT	2
__libc_creat	.symtab	0x10011450	16	FUNC	<unknown>	DEFAULT	2
__libc_fcntl	.symtab	0x1000a404	132	FUNC	<unknown>	DEFAULT	2
__libc_fcntl64	.symtab	0x1000a488	100	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x1000a57c	72	FUNC	<unknown>	DEFAULT	2
__libc_getpid	.symtab	0x1000a718	72	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0x100154c4	128	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x10011390	72	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x100113d8	120	FUNC	<unknown>	DEFAULT	2
__libc_poll	.symtab	0x1000a838	72	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x10015544	72	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x1000f7fc	56	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x1000a880	72	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x1000f834	56	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x1000f86c	64	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x10014330	196	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x1002be08	4	OBJECT	<unknown>	DEFAULT	11
__libc_system	.symtab	0x1001048c	340	FUNC	<unknown>	DEFAULT	2
__libc_waitpid	.symtab	0x1000a9a0	8	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x1000a9a8	72	FUNC	<unknown>	DEFAULT	2
__malloc_heap	.symtab	0x1002bd80	4	OBJECT	<unknown>	DEFAULT	10
__malloc_heap_lock	.symtab	0x10032294	24	OBJECT	<unknown>	DEFAULT	12
__malloc_sbrk_lock	.symtab	0x100334d4	24	OBJECT	<unknown>	DEFAULT	12
__nameserver	.symtab	0x100334fc	12	OBJECT	<unknown>	HIDDEN	12
__nameservers	.symtab	0x1002be38	4	OBJECT	<unknown>	HIDDEN	11
__open_etc_hosts	.symtab	0x10015114	100	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x10013bb8	724	FUNC	<unknown>	HIDDEN	2
__opensock	.symtab	0x100142d4	92	FUNC	<unknown>	HIDDEN	2
__pagesize	.symtab	0x1002be10	4	OBJECT	<unknown>	DEFAULT	11
__preinit_array_end	.symtab	0x1002b000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__preinit_array_start	.symtab	0x1002b000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__pthread_initialize_minimal	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x10010dac	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x10010dac	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x10010dac	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x10010dac	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x10010dac	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_void	.symtab	0x10010db4	4	FUNC	<unknown>	DEFAULT	2
__raise	.symtab	0x10015494	48	FUNC	<unknown>	HIDDEN	2
__read_etc_hosts_r	.symtab	0x10015178	796	FUNC	<unknown>	HIDDEN	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__resolv_lock	.symtab	0x1002bd00	24	OBJECT	<unknown>	DEFAULT	9
__rtld_fini	.symtab	0x1002be18	4	OBJECT	<unknown>	HIDDEN	11
__searchdomain	.symtab	0x100334ec	16	OBJECT	<unknown>	HIDDEN	12
__searchdomains	.symtab	0x1002be3c	4	OBJECT	<unknown>	HIDDEN	11
__sigaddset	.symtab	0x100144fc	40	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x10014524	40	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x100144d4	40	FUNC	<unknown>	DEFAULT	2
__socketcall	.symtab	0x10011114	72	FUNC	<unknown>	HIDDEN	2
__socketcall.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__stdin	.symtab	0x1002bd70	4	OBJECT	<unknown>	DEFAULT	10
__stdio_READ	.symtab	0x10014924	116	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x100117a0	224	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x10014998	252	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x10011880	364	FUNC	<unknown>	HIDDEN	2
__stdio_init_mutex	.symtab	0x1000b5c8	16	FUNC	<unknown>	HIDDEN	2
__stdio_mutex_initializer.3862	.symtab	0x100198c8	24	OBJECT	<unknown>	DEFAULT	4
__stdio_rfill	.symtab	0x10014a94	72	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x10014b80	88	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x10014adc	164	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x100119ec	248	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x1000b698	80	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x1002bd74	4	OBJECT	<unknown>	DEFAULT	10
__syscall_error	.symtab	0x100146b8	52	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_rt_sigaction	.symtab	0x10014720	72	FUNC	<unknown>	HIDDEN	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uClibc_fini	.symtab	0x10010d18	148	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x10010e18	128	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x10010e98	620	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x1002bd84	4	OBJECT	<unknown>	HIDDEN	10
__vfork	.symtab	0x10011104	16	FUNC	<unknown>	HIDDEN	2
__xpg_strerror_r	.symtab	0x1000d508	268	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_charpad	.symtab	0x1000b798	96	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_dl_aux_init	.symtab	0x1001469c	28	FUNC	<unknown>	DEFAULT	2
_dl_phdr	.symtab	0x1002be44	4	OBJECT	<unknown>	DEFAULT	11
_dl_phnum	.symtab	0x1002be48	4	OBJECT	<unknown>	DEFAULT	11
_edata	.symtab	0x1002bd98	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x10033588	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno	.symtab	0x1002be20	4	OBJECT	<unknown>	DEFAULT	11
_exit	.symtab	0x1001115c	60	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x1001570c	16	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x10030284	8192	OBJECT	<unknown>	DEFAULT	12
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x1000b7f8	160	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x10011c98	1732	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_h_errno	.symtab	0x1002be24	4	OBJECT	<unknown>	DEFAULT	11
_init	.symtab	0x10000094	16	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x10011ae4	128	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_init	.symtab	0x1000bf08	188	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x1000c2d0	1304	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x1000bfc4	92	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x1000c020	624	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x1000c290	64	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x10010db4	4	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x10010db4	4	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_sigintr	.symtab	0x10033508	128	OBJECT	<unknown>	HIDDEN	12
_start	.symtab	0x100001f0	72	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x1000b298	700	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x1000b554	116	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x1002bd78	4	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_add_lock	.symtab	0x1002b9ec	24	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_dec_use	.symtab	0x1000ca50	288	FUNC	<unknown>	DEFAULT	2
_stdio_openlist_del_count	.symtab	0x1002bdfc	4	OBJECT	<unknown>	DEFAULT	11
_stdio_openlist_del_lock	.symtab	0x1002ba04	24	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_use_count	.symtab	0x1002bdf8	4	OBJECT	<unknown>	DEFAULT	11
_stdio_streams	.symtab	0x1002ba1c	240	OBJECT	<unknown>	DEFAULT	9
_stdio_term	.symtab	0x1000b5d8	192	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x1002bd7c	4	OBJECT	<unknown>	DEFAULT	10
_stdlib_strto_l	.symtab	0x100105fc	436	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x10011b64	60	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x10019998	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x10011ba0	248	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x1000b898	1648	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x1001454c	336	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
accept	.symtab	0x1000f6f4	52	FUNC	<unknown>	DEFAULT	2
accept.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
actualparent	.symtab	0x1002bdc8	4	OBJECT	<unknown>	DEFAULT	11
advance_telstate	.symtab	0x10005ef8	136	FUNC	<unknown>	DEFAULT	2
advances	.symtab	0x1002b868	28	OBJECT	<unknown>	DEFAULT	9
advances2	.symtab	0x1002b8c8	44	OBJECT	<unknown>	DEFAULT	9
ak47scan	.symtab	0x10007540	276	FUNC	<unknown>	DEFAULT	2
ak47scantoggle	.symtab	0x10007654	496	FUNC	<unknown>	DEFAULT	2
ak47telscan	.symtab	0x10006028	5400	FUNC	<unknown>	DEFAULT	2
append	.symtab	0x10008004	100	FUNC	<unknown>	DEFAULT	2
asprintf	.symtab	0x1000acf0	128	FUNC	<unknown>	DEFAULT	2
asprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
atoi	.symtab	0x100105e0	12	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x100105e0	12	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bcopy	.symtab	0x1000d614	16	FUNC	<unknown>	DEFAULT	2
bcopy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
been_there_done_that	.symtab	0x1002be40	4	OBJECT	<unknown>	DEFAULT	11
been_there_done_that.2829	.symtab	0x1002be1c	4	OBJECT	<unknown>	DEFAULT	11
bind	.symtab	0x1000f728	52	FUNC	<unknown>	DEFAULT	2
bind.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
blacknurse	.symtab	0x10001e1c	804	FUNC	<unknown>	DEFAULT	2
botkill	.symtab	0x10007844	200	FUNC	<unknown>	DEFAULT	2
brk	.symtab	0x100146ec	52	FUNC	<unknown>	DEFAULT	2
bsd_signal	.symtab	0x100143f4	224	FUNC	<unknown>	DEFAULT	2
buf.2641	.symtab	0x10032284	16	OBJECT	<unknown>	DEFAULT	12
c	.symtab	0x1002b8f4	4	OBJECT	<unknown>	DEFAULT	9
call___do_global_ctors_aux	.symtab	0x100156f0	0	FUNC	<unknown>	DEFAULT	2
call___do_global_dtors_aux	.symtab	0x1000014c	0	FUNC	<unknown>	DEFAULT	2
call_frame_dummy	.symtab	0x100001d4	0	FUNC	<unknown>	DEFAULT	2
capsaicin2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
chan	.symtab	0x1002bdec	4	OBJECT	<unknown>	DEFAULT	11
changeservers	.symtab	0x1002bd9c	4	OBJECT	<unknown>	DEFAULT	11
chdir	.symtab	0x1000a4ec	72	FUNC	<unknown>	DEFAULT	2
chdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
clock_getres	.symtab	0x10011198	72	FUNC	<unknown>	DEFAULT	2
clock_getres.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x1000a534	72	FUNC	<unknown>	DEFAULT	2
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
completed.3069	.symtab	0x1002be50	1	OBJECT	<unknown>	DEFAULT	12
con	.symtab	0x100093f8	852	FUNC	<unknown>	DEFAULT	2
connect	.symtab	0x1000f75c	52	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
contains_fail	.symtab	0x10005bd4	72	FUNC	<unknown>	DEFAULT	2
contains_response	.symtab	0x10005c1c	116	FUNC	<unknown>	DEFAULT	2
contains_string	.symtab	0x10005a9c	240	FUNC	<unknown>	DEFAULT	2
contains_success	.symtab	0x10005b8c	72	FUNC	<unknown>	DEFAULT	2
creat	.symtab	0x10011450	16	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum	.symtab	0x10000260	236	FUNC	<unknown>	DEFAULT	2
data_start	.symtab	0x1002b020	0	NOTYPE	<unknown>	DEFAULT	9
decodea.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
disable	.symtab	0x10001844	372	FUNC	<unknown>	DEFAULT	2
disabled	.symtab	0x1002bda0	1	OBJECT	<unknown>	DEFAULT	11
dispass	.symtab	0x100322d4	256	OBJECT	<unknown>	DEFAULT	12
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dns	.symtab	0x10004548	768	FUNC	<unknown>	DEFAULT	2
dns_format	.symtab	0x10003d40	340	FUNC	<unknown>	DEFAULT	2
dns_hdr_create	.symtab	0x10003e94	156	FUNC	<unknown>	DEFAULT	2
dns_send	.symtab	0x10003f30	1040	FUNC	<unknown>	DEFAULT	2
dnsflood	.symtab	0x10004340	520	FUNC	<unknown>	DEFAULT	2
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
download	.symtab	0x10000f8c	1288	FUNC	<unknown>	DEFAULT	2
dup2	.symtab	0x100111e0	72	FUNC	<unknown>	DEFAULT	2
dup2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
enable	.symtab	0x100019b8	328	FUNC	<unknown>	DEFAULT	2
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
endservent	.symtab	0x10012c10	128	FUNC	<unknown>	DEFAULT	2
environ	.symtab	0x1002be0c	4	OBJECT	<unknown>	DEFAULT	11
errno	.symtab	0x1002be20	4	OBJECT	<unknown>	DEFAULT	11
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execfile	.symtab	0x100323d4	256	OBJECT	<unknown>	DEFAULT	12
execl	.symtab	0x10010834	308	FUNC	<unknown>	DEFAULT	2
execl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execve	.symtab	0x10011228	72	FUNC	<unknown>	DEFAULT	2
execve.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x100107b0	132	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x1001ae78	72	OBJECT	<unknown>	DEFAULT	4
fails	.symtab	0x1002b884	36	OBJECT	<unknown>	DEFAULT	9
fastflux	.symtab	0x100082e4	508	FUNC	<unknown>	DEFAULT	2
fclose	.symtab	0x1000aa1c	332	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x1000a404	132	FUNC	<unknown>	DEFAULT	2
fcntl64	.symtab	0x1000a488	100	FUNC	<unknown>	DEFAULT	2
fdopen	.symtab	0x1001173c	100	FUNC	<unknown>	DEFAULT	2
fdopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
feof	.symtab	0x1000c7e8	124	FUNC	<unknown>	DEFAULT	2
feof.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fflush_unlocked	.symtab	0x1000cb70	432	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x1001235c	312	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x1000c864	148	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x1000cd20	196	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
filter	.symtab	0x10000780	176	FUNC	<unknown>	DEFAULT	2
flooders	.symtab	0x1002b8fc	176	OBJECT	<unknown>	DEFAULT	9
fmt	.symtab	0x1001ae60	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x1000ab68	12	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0x1000a57c	72	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fprintf	.symtab	0x1000ac70	128	FUNC	<unknown>	DEFAULT	2
fprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputc	.symtab	0x1000c8f8	204	FUNC	<unknown>	DEFAULT	2
fputc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputc_unlocked	.symtab	0x1000cde4	292	FUNC	<unknown>	DEFAULT	2
fputc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs	.symtab	0x1000c9c4	140	FUNC	<unknown>	DEFAULT	2
fputs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs_unlocked	.symtab	0x1000cf08	92	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x10000168	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x1000fa74	256	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
freeaddrinfo	.symtab	0x1000e5dc	64	FUNC	<unknown>	DEFAULT	2
fseek	.symtab	0x10014768	16	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x10014768	16	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x10014808	284	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fwrite_unlocked	.symtab	0x1000cf64	184	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gaih	.symtab	0x1001a4f4	24	OBJECT	<unknown>	DEFAULT	4
gaih_inet	.symtab	0x1000da58	2948	FUNC	<unknown>	DEFAULT	2
gaih_inet_serv	.symtab	0x1000d970	232	FUNC	<unknown>	DEFAULT	2
gaih_inet_typeproto	.symtab	0x1001a50c	35	OBJECT	<unknown>	DEFAULT	4
get	.symtab	0x10001494	356	FUNC	<unknown>	DEFAULT	2
getBuild	.symtab	0x10000238	40	FUNC	<unknown>	DEFAULT	2
getDatIP	.symtab	0x10005338	1460	FUNC	<unknown>	DEFAULT	2
getHost	.symtab	0x10002a4c	124	FUNC	<unknown>	DEFAULT	2
getPublicIP	.symtab	0x10008194	184	FUNC	<unknown>	DEFAULT	2
get_hosts_byaddr_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
get_telstate_host	.symtab	0x10005ea0	88	FUNC	<unknown>	DEFAULT	2
getaddrinfo	.symtab	0x1000e61c	756	FUNC	<unknown>	DEFAULT	2
getaddrinfo.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getc_unlocked	.symtab	0x1001235c	312	FUNC	<unknown>	DEFAULT	2
getcwd	.symtab	0x1000a5c4	256	FUNC	<unknown>	DEFAULT	2
getcwd.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdtablesize	.symtab	0x1000a6c4	56	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x10011270	72	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x100112b8	72	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x10011300	72	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyaddr_r	.symtab	0x1000f3bc	824	FUNC	<unknown>	DEFAULT	2
gethostbyaddr_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2_r	.symtab	0x1000f0e4	728	FUNC	<unknown>	DEFAULT	2
gethostbyname2_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0x10013f90	836	FUNC	<unknown>	DEFAULT	2
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getmyip	.symtab	0x1000824c	152	FUNC	<unknown>	DEFAULT	2
getpagesize	.symtab	0x1000a6fc	28	FUNC	<unknown>	DEFAULT	2
getpagesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x1000a718	72	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getppid	.symtab	0x1000a760	72	FUNC	<unknown>	DEFAULT	2
getppid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x1000a7a8	72	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getservbyname	.symtab	0x10012f88	88	FUNC	<unknown>	DEFAULT	2
getservbyname_r	.symtab	0x10012e6c	284	FUNC	<unknown>	DEFAULT	2
getservbyport	.symtab	0x10012e14	88	FUNC	<unknown>	DEFAULT	2
getservbyport_r	.symtab	0x10012d30	228	FUNC	<unknown>	DEFAULT	2
getservent	.symtab	0x10012bd0	64	FUNC	<unknown>	DEFAULT	2
getservent_r	.symtab	0x10012990	576	FUNC	<unknown>	DEFAULT	2
getservice.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x1000f790	60	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x10011348	72	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
h_errno	.symtab	0x1002be24	4	OBJECT	<unknown>	DEFAULT	11
head	.symtab	0x1002bddc	4	OBJECT	<unknown>	DEFAULT	11
heap_alloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
heap_alloc_at.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
heap_free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
help	.symtab	0x100079f8	1048	FUNC	<unknown>	DEFAULT	2
histClear	.symtab	0x1000813c	88	FUNC	<unknown>	DEFAULT	2
hold	.symtab	0x10003c10	304	FUNC	<unknown>	DEFAULT	2
host2ip	.symtab	0x10001b00	220	FUNC	<unknown>	DEFAULT	2
htonl	.symtab	0x1000d968	4	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0x1000d96c	4	FUNC	<unknown>	DEFAULT	2
i.5503	.symtab	0x1002bdb0	4	OBJECT	<unknown>	DEFAULT	11
i.5545	.symtab	0x1002b8f8	4	OBJECT	<unknown>	DEFAULT	9
ident	.symtab	0x1002bdb8	4	OBJECT	<unknown>	DEFAULT	11
identd	.symtab	0x1000095c	884	FUNC	<unknown>	DEFAULT	2
if_freenameindex	.symtab	0x10013310	88	FUNC	<unknown>	DEFAULT	2
if_index.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
if_indextoname	.symtab	0x10012fe0	172	FUNC	<unknown>	DEFAULT	2
if_nameindex	.symtab	0x10013134	476	FUNC	<unknown>	DEFAULT	2
if_nametoindex	.symtab	0x1001308c	168	FUNC	<unknown>	DEFAULT	2
in6_addr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
in6addr_any	.symtab	0x1001a55c	16	OBJECT	<unknown>	DEFAULT	4
in6addr_loopback	.symtab	0x1001a56c	16	OBJECT	<unknown>	DEFAULT	4
in_cksum	.symtab	0x10000d60	264	FUNC	<unknown>	DEFAULT	2
index	.symtab	0x10012768	256	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x1000f0b0	52	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x10013368	192	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa	.symtab	0x1000f07c	52	FUNC	<unknown>	DEFAULT	2
inet_ntoa.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa_r	.symtab	0x1000f000	124	FUNC	<unknown>	DEFAULT	2
inet_ntop	.symtab	0x1000ed5c	676	FUNC	<unknown>	DEFAULT	2
inet_ntop4	.symtab	0x1000ebfc	352	FUNC	<unknown>	DEFAULT	2
inet_pton	.symtab	0x1000e9f0	524	FUNC	<unknown>	DEFAULT	2
inet_pton4	.symtab	0x1000e910	224	FUNC	<unknown>	DEFAULT	2
infected	.symtab	0x1002bd4c	8	OBJECT	<unknown>	DEFAULT	10
init_rand	.symtab	0x10001bdc	232	FUNC	<unknown>	DEFAULT	2
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initial_fa	.symtab	0x1002bb10	264	OBJECT	<unknown>	DEFAULT	9
initstate	.symtab	0x10010048	136	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x100103a4	232	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x1000a31c	232	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isatty	.symtab	0x1000d734	44	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ismaster	.symtab	0x10008068	212	FUNC	<unknown>	DEFAULT	2
junk	.symtab	0x100034e4	304	FUNC	<unknown>	DEFAULT	2
key	.symtab	0x1002bde4	4	OBJECT	<unknown>	DEFAULT	11
kill	.symtab	0x1000a7f0	72	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
killall	.symtab	0x10007e10	340	FUNC	<unknown>	DEFAULT	2
killd	.symtab	0x10007f64	160	FUNC	<unknown>	DEFAULT	2
knownBots	.symtab	0x1002b030	776	OBJECT	<unknown>	DEFAULT	9
legit	.symtab	0x1002bd44	8	OBJECT	<unknown>	DEFAULT	10
lengthd.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lengthq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/powerpc/brk.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/powerpc/crt1.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/powerpc/crti.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/powerpc/crtn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/powerpc/vfork.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
limiter	.symtab	0x1002bdbc	4	OBJECT	<unknown>	DEFAULT	11
listFork	.symtab	0x10002598	312	FUNC	<unknown>	DEFAULT	2
listen	.symtab	0x1000f7cc	48	FUNC	<unknown>	DEFAULT	2
listen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x100154c4	128	FUNC	<unknown>	DEFAULT	2
main	.symtab	0x100098ac	2672	FUNC	<unknown>	DEFAULT	2
makeFukdString	.symtab	0x1000974c	220	FUNC	<unknown>	DEFAULT	2
makeRandomShit	.symtab	0x10002140	220	FUNC	<unknown>	DEFAULT	2
malloc	.symtab	0x1000f91c	344	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
masters	.symtab	0x1002b024	12	OBJECT	<unknown>	DEFAULT	9
memchr	.symtab	0x10012538	264	FUNC	<unknown>	DEFAULT	2
memchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memcpy	.symtab	0x1000d01c	156	FUNC	<unknown>	DEFAULT	2
memcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memmove	.symtab	0x10012494	164	FUNC	<unknown>	DEFAULT	2
memmove.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mempcpy	.symtab	0x10012640	52	FUNC	<unknown>	DEFAULT	2
mempcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memrchr	.symtab	0x10012674	244	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x1000d0b8	144	FUNC	<unknown>	DEFAULT	2
memset.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mfork	.symtab	0x10000604	380	FUNC	<unknown>	DEFAULT	2
move	.symtab	0x1000795c	156	FUNC	<unknown>	DEFAULT	2
msgs	.symtab	0x1002b9ac	64	OBJECT	<unknown>	DEFAULT	9
mygethostbyname	.symtab	0x10000e68	292	FUNC	<unknown>	DEFAULT	2
mylock	.symtab	0x1003026c	24	OBJECT	<unknown>	DEFAULT	12
mylock	.symtab	0x1002bc18	24	OBJECT	<unknown>	DEFAULT	9
mylock	.symtab	0x1002bce4	24	OBJECT	<unknown>	DEFAULT	9
mylock	.symtab	0x100322bc	24	OBJECT	<unknown>	DEFAULT	12
mylock	.symtab	0x1002bd18	24	OBJECT	<unknown>	DEFAULT	9
nanosleep	.symtab	0x10011390	72	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
negotiate	.symtab	0x100058ec	432	FUNC	<unknown>	DEFAULT	2
next_start.1106	.symtab	0x1002be00	4	OBJECT	<unknown>	DEFAULT	11
nick	.symtab	0x1002bdc0	4	OBJECT	<unknown>	DEFAULT	11
nickc	.symtab	0x1000164c	216	FUNC	<unknown>	DEFAULT	2
ntohl	.symtab	0x1000d960	4	FUNC	<unknown>	DEFAULT	2
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0x1000d964	4	FUNC	<unknown>	DEFAULT	2
ntop.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
nummasters	.symtab	0x1002bd3c	4	OBJECT	<unknown>	DEFAULT	10
numpids	.symtab	0x1002bdac	4	OBJECT	<unknown>	DEFAULT	11
numservers	.symtab	0x1002bd30	4	OBJECT	<unknown>	DEFAULT	10
object.3150	.symtab	0x1002be54	24	OBJECT	<unknown>	DEFAULT	12
open	.symtab	0x100113d8	120	FUNC	<unknown>	DEFAULT	2
open.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opennameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opensock.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
p.3067	.symtab	0x1002b01c	0	OBJECT	<unknown>	DEFAULT	9
passwords	.symtab	0x1002b618	592	OBJECT	<unknown>	DEFAULT	9
pclose	.symtab	0x1000af68	260	FUNC	<unknown>	DEFAULT	2
perror	.symtab	0x1000ab74	68	FUNC	<unknown>	DEFAULT	2
perror.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pid	.symtab	0x1002bdb4	4	OBJECT	<unknown>	DEFAULT	11
pids	.symtab	0x1002bdf0	4	OBJECT	<unknown>	DEFAULT	11
pipe	.symtab	0x10011460	72	FUNC	<unknown>	DEFAULT	2
pipe.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
poll	.symtab	0x1000a838	72	FUNC	<unknown>	DEFAULT	2
poll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
popen	.symtab	0x1000b06c	556	FUNC	<unknown>	DEFAULT	2
popen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
popen_list	.symtab	0x1002bdf4	4	OBJECT	<unknown>	DEFAULT	11
poww	.symtab	0x10000cd0	144	FUNC	<unknown>	DEFAULT	2
pps	.symtab	0x1002bdd4	4	OBJECT	<unknown>	DEFAULT	11
prefix.4074	.symtab	0x100198f0	12	OBJECT	<unknown>	DEFAULT	4
print	.symtab	0x10004c6c	1564	FUNC	<unknown>	DEFAULT	2
printchar	.symtab	0x10004848	128	FUNC	<unknown>	DEFAULT	2
printi	.symtab	0x10004a6c	512	FUNC	<unknown>	DEFAULT	2
prints	.symtab	0x100048c8	420	FUNC	<unknown>	DEFAULT	2
putc	.symtab	0x1000c8f8	204	FUNC	<unknown>	DEFAULT	2
putc_unlocked	.symtab	0x1000cde4	292	FUNC	<unknown>	DEFAULT	2
puts	.symtab	0x1000abb8	168	FUNC	<unknown>	DEFAULT	2
puts.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
qual_chars.4079	.symtab	0x10019904	20	OBJECT	<unknown>	DEFAULT	4
raise	.symtab	0x10015494	48	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x1000ff54	4	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_cmwc	.symtab	0x10001cc4	344	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x1000ff58	108	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x1001a5ac	40	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x10010230	144	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randstring	.symtab	0x10000830	300	FUNC	<unknown>	DEFAULT	2
randtbl	.symtab	0x1002bc4c	128	OBJECT	<unknown>	DEFAULT	9
rawmemchr	.symtab	0x10014bd8	184	FUNC	<unknown>	DEFAULT	2
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0x10015544	72	FUNC	<unknown>	DEFAULT	2
read.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read_etc_hosts_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read_until_response	.symtab	0x10005dd0	208	FUNC	<unknown>	DEFAULT	2
read_with_timeout	.symtab	0x10005c90	320	FUNC	<unknown>	DEFAULT	2
realloc	.symtab	0x1000fb74	304	FUNC	<unknown>	DEFAULT	2
realloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
realrand	.symtab	0x10001724	140	FUNC	<unknown>	DEFAULT	2
recv	.symtab	0x1000f7fc	56	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rekdevice	.symtab	0x1002bd40	4	OBJECT	<unknown>	DEFAULT	10
reset_telstate	.symtab	0x10005f80	72	FUNC	<unknown>	DEFAULT	2
rewind	.symtab	0x10014778	144	FUNC	<unknown>	DEFAULT	2
rewind.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rnd	.symtab	0x1002bde8	4	OBJECT	<unknown>	DEFAULT	11
rndnick	.symtab	0x100017b0	148	FUNC	<unknown>	DEFAULT	2
rseed	.symtab	0x100324d4	4096	OBJECT	<unknown>	DEFAULT	12
rsi	.symtab	0x1002bdcc	4	OBJECT	<unknown>	DEFAULT	11
sbrk	.symtab	0x100114a8	112	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
scanPid	.symtab	0x1002bd98	4	OBJECT	<unknown>	DEFAULT	11
sclose	.symtab	0x10005fc8	96	FUNC	<unknown>	DEFAULT	2
select	.symtab	0x1000a880	72	FUNC	<unknown>	DEFAULT	2
select.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send	.symtab	0x1000f834	56	FUNC	<unknown>	DEFAULT	2
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sendHOLD	.symtab	0x10003614	1532	FUNC	<unknown>	DEFAULT	2
sendHTTP	.symtab	0x10002bd4	496	FUNC	<unknown>	DEFAULT	2
sendJUNK	.symtab	0x10002f50	1428	FUNC	<unknown>	DEFAULT	2
sendSTD	.symtab	0x100026d0	892	FUNC	<unknown>	DEFAULT	2
sendto	.symtab	0x1000f86c	64	FUNC	<unknown>	DEFAULT	2
sendto.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
serv	.symtab	0x100322ac	16	OBJECT	<unknown>	DEFAULT	12
serv_stayopen	.symtab	0x1002be30	4	OBJECT	<unknown>	DEFAULT	11
servbuf	.symtab	0x1002be28	4	OBJECT	<unknown>	DEFAULT	11
server	.symtab	0x1002bdd8	4	OBJECT	<unknown>	DEFAULT	11
servers	.symtab	0x1002bd34	8	OBJECT	<unknown>	DEFAULT	10
servf	.symtab	0x1002be2c	4	OBJECT	<unknown>	DEFAULT	11
setservent	.symtab	0x10012c90	160	FUNC	<unknown>	DEFAULT	2
setsid	.symtab	0x1000a8c8	72	FUNC	<unknown>	DEFAULT	2
setsid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsockopt	.symtab	0x1000f8ac	60	FUNC	<unknown>	DEFAULT	2
setsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0x1000ffc4	132	FUNC	<unknown>	DEFAULT	2
setstate_r	.symtab	0x1001013c	244	FUNC	<unknown>	DEFAULT	2
sigaction	.symtab	0x10014330	196	FUNC	<unknown>	DEFAULT	2
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
signal	.symtab	0x100143f4	224	FUNC	<unknown>	DEFAULT	2
signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask	.symtab	0x10011518	120	FUNC	<unknown>	DEFAULT	2
sigprocmask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigsetops.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sleep	.symtab	0x10010968	468	FUNC	<unknown>	DEFAULT	2
sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sleeptime	.symtab	0x1002bd54	4	OBJECT	<unknown>	DEFAULT	10
sock	.symtab	0x1002bdc4	4	OBJECT	<unknown>	DEFAULT	11
socket	.symtab	0x1000f8e8	52	FUNC	<unknown>	DEFAULT	2
socket.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket_connect	.symtab	0x10002ac8	268	FUNC	<unknown>	DEFAULT	2
spec_and_mask.4078	.symtab	0x10019918	16	OBJECT	<unknown>	DEFAULT	4
spec_base.4073	.symtab	0x100198fc	7	OBJECT	<unknown>	DEFAULT	4
spec_chars.4075	.symtab	0x10019944	21	OBJECT	<unknown>	DEFAULT	4
spec_flags.4074	.symtab	0x1001995c	8	OBJECT	<unknown>	DEFAULT	4
spec_or_mask.4077	.symtab	0x10019928	16	OBJECT	<unknown>	DEFAULT	4
spec_ranges.4076	.symtab	0x10019938	9	OBJECT	<unknown>	DEFAULT	4
spoofs	.symtab	0x1002bda4	4	OBJECT	<unknown>	DEFAULT	11
spoofsm	.symtab	0x1002bda8	4	OBJECT	<unknown>	DEFAULT	11
sprintf	.symtab	0x1000ad70	140	FUNC	<unknown>	DEFAULT	2
sprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
srand	.symtab	0x100100d0	108	FUNC	<unknown>	DEFAULT	2
srandom	.symtab	0x100100d0	108	FUNC	<unknown>	DEFAULT	2
srandom_r	.symtab	0x100102c0	228	FUNC	<unknown>	DEFAULT	2
static_id	.symtab	0x1002bcfc	2	OBJECT	<unknown>	DEFAULT	9
static_ns	.symtab	0x1002be34	4	OBJECT	<unknown>	DEFAULT	11
stderr	.symtab	0x1002bd6c	4	OBJECT	<unknown>	DEFAULT	10
stdin	.symtab	0x1002bd64	4	OBJECT	<unknown>	DEFAULT	10
stdout	.symtab	0x1002bd68	4	OBJECT	<unknown>	DEFAULT	10
strcasecmp	.symtab	0x1000d624	80	FUNC	<unknown>	DEFAULT	2
strcasecmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcasestr	.symtab	0x1000d674	100	FUNC	<unknown>	DEFAULT	2
strcasestr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchr	.symtab	0x10012768	256	FUNC	<unknown>	DEFAULT	2
strchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcmp	.symtab	0x1000d148	52	FUNC	<unknown>	DEFAULT	2
strcmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcoll	.symtab	0x1000d148	52	FUNC	<unknown>	DEFAULT	2
strcpy	.symtab	0x1000d17c	32	FUNC	<unknown>	DEFAULT	2
strcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strdup	.symtab	0x1000d6d8	80	FUNC	<unknown>	DEFAULT	2
strdup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strerror_r	.symtab	0x1000d508	268	FUNC	<unknown>	DEFAULT	2
strlen	.symtab	0x1000d19c	164	FUNC	<unknown>	DEFAULT	2
strlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncat	.symtab	0x10014c90	208	FUNC	<unknown>	DEFAULT	2
strncat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncmp	.symtab	0x1000d240	236	FUNC	<unknown>	DEFAULT	2
strncmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncpy	.symtab	0x1000d32c	188	FUNC	<unknown>	DEFAULT	2
strncpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strnlen	.symtab	0x1000d3e8	240	FUNC	<unknown>	DEFAULT	2
strnlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strpbrk	.symtab	0x10012908	60	FUNC	<unknown>	DEFAULT	2
strpbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strspn	.symtab	0x10014d60	76	FUNC	<unknown>	DEFAULT	2
strspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok	.symtab	0x1000d728	12	FUNC	<unknown>	DEFAULT	2
strtok.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok_r	.symtab	0x10012868	160	FUNC	<unknown>	DEFAULT	2
strtok_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtol	.symtab	0x100105ec	8	FUNC	<unknown>	DEFAULT	2
strtol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtoul	.symtab	0x100105f4	8	FUNC	<unknown>	DEFAULT	2
strtoul.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strwildmatch	.symtab	0x1000034c	484	FUNC	<unknown>	DEFAULT	2
successes	.symtab	0x1002b8a8	32	OBJECT	<unknown>	DEFAULT	9
sysconf	.symtab	0x10010b3c	400	FUNC	<unknown>	DEFAULT	2
sysconf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
system	.symtab	0x1001048c	340	FUNC	<unknown>	DEFAULT	2
system.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
szprintf	.symtab	0x10005288	176	FUNC	<unknown>	DEFAULT	2
tcgetattr	.symtab	0x1000d760	156	FUNC	<unknown>	DEFAULT	2
tcgetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcsetattr	.symtab	0x1000d7fc	356	FUNC	<unknown>	DEFAULT	2
tcsetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tehport	.symtab	0x1002bde0	4	OBJECT	<unknown>	DEFAULT	11
textBuffer.4986	.symtab	0x1002be6c	1024	OBJECT	<unknown>	DEFAULT	12
thanks	.symtab	0x1002bd58	4	OBJECT	<unknown>	DEFAULT	10
time	.symtab	0x1000a910	72	FUNC	<unknown>	DEFAULT	2
time.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tolower	.symtab	0x100115d8	32	FUNC	<unknown>	DEFAULT	2
tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
touchMyself	.symtab	0x10009828	132	FUNC	<unknown>	DEFAULT	2
toupper	.symtab	0x1000a9f0	32	FUNC	<unknown>	DEFAULT	2
toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
type_codes	.symtab	0x10019964	24	OBJECT	<unknown>	DEFAULT	4
type_sizes	.symtab	0x1001997c	12	OBJECT	<unknown>	DEFAULT	4
umask	.symtab	0x1000a958	72	FUNC	<unknown>	DEFAULT	2
umask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
unknown	.symtab	0x1000221c	892	FUNC	<unknown>	DEFAULT	2
unknown.1128	.symtab	0x10019988	14	OBJECT	<unknown>	DEFAULT	4
unsafe_state	.symtab	0x1002bc30	28	OBJECT	<unknown>	DEFAULT	9
user	.symtab	0x1002bdd0	4	OBJECT	<unknown>	DEFAULT	11
usernames	.symtab	0x1002b3c8	592	OBJECT	<unknown>	DEFAULT	9
usleep	.symtab	0x10010ccc	76	FUNC	<unknown>	DEFAULT	2
usleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
vasprintf	.symtab	0x1000adfc	160	FUNC	<unknown>	DEFAULT	2
vasprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
version	.symtab	0x100015f8	84	FUNC	<unknown>	DEFAULT	2
vfork	.symtab	0x10011104	16	FUNC	<unknown>	DEFAULT	2
vfprintf	.symtab	0x1000b6e8	176	FUNC	<unknown>	DEFAULT	2
vfprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
vsnprintf	.symtab	0x1000ae9c	204	FUNC	<unknown>	DEFAULT	2
vsnprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
vsprintf	.symtab	0x1000ac60	16	FUNC	<unknown>	DEFAULT	2
vsprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wait4	.symtab	0x10011590	72	FUNC	<unknown>	DEFAULT	2
wait4.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
waitpid	.symtab	0x1000a9a0	8	FUNC	<unknown>	DEFAULT	2
waitpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcrtomb	.symtab	0x10011604	92	FUNC	<unknown>	DEFAULT	2
wcrtomb.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsnrtombs	.symtab	0x10011670	204	FUNC	<unknown>	DEFAULT	2
wcsnrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsrtombs	.symtab	0x10011660	16	FUNC	<unknown>	DEFAULT	2
wcsrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
write	.symtab	0x1000a9a8	72	FUNC	<unknown>	DEFAULT	2
write.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
xdigits.3080	.symtab	0x1001a544	17	OBJECT	<unknown>	DEFAULT	4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 23, 2024 11:03:02.439182997 CET	50306	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:03:02.558932066 CET	6780	50306	95.234.158.87	192.168.2.15
Nov 23, 2024 11:03:02.559010029 CET	50306	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:03:03.467048883 CET	50306	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:03:03.586721897 CET	6780	50306	95.234.158.87	192.168.2.15
Nov 23, 2024 11:03:03.690001965 CET	6780	50306	95.234.158.87	192.168.2.15
Nov 23, 2024 11:03:03.690015078 CET	6780	50306	95.234.158.87	192.168.2.15
Nov 23, 2024 11:03:03.690045118 CET	50306	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:03:03.690466881 CET	50306	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:03:03.810148954 CET	6780	50306	95.234.158.87	192.168.2.15
Nov 23, 2024 11:03:08.693134069 CET	50308	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:03:08.812633991 CET	6780	50308	95.234.158.87	192.168.2.15
Nov 23, 2024 11:03:08.812711000 CET	50308	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:03:09.697951078 CET	50308	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:03:09.817502022 CET	6780	50308	95.234.158.87	192.168.2.15
Nov 23, 2024 11:03:09.961023092 CET	6780	50308	95.234.158.87	192.168.2.15
Nov 23, 2024 11:03:09.961034060 CET	6780	50308	95.234.158.87	192.168.2.15
Nov 23, 2024 11:03:09.961167097 CET	50308	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:03:09.961167097 CET	50308	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:03:10.081000090 CET	6780	50308	95.234.158.87	192.168.2.15
Nov 23, 2024 11:03:14.963187933 CET	50310	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:03:15.178694010 CET	6780	50310	95.234.158.87	192.168.2.15
Nov 23, 2024 11:03:15.178889990 CET	50310	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:03:15.967644930 CET	50310	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:03:16.087215900 CET	6780	50310	95.234.158.87	192.168.2.15
Nov 23, 2024 11:03:16.349282026 CET	6780	50310	95.234.158.87	192.168.2.15
Nov 23, 2024 11:03:16.349435091 CET	6780	50310	95.234.158.87	192.168.2.15
Nov 23, 2024 11:03:16.349453926 CET	50310	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:03:16.349453926 CET	50310	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:03:16.349478006 CET	50310	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:03:16.468923092 CET	6780	50310	95.234.158.87	192.168.2.15
Nov 23, 2024 11:03:21.352610111 CET	50312	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:03:21.472223997 CET	6780	50312	95.234.158.87	192.168.2.15
Nov 23, 2024 11:03:21.472304106 CET	50312	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:03:22.356915951 CET	50312	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:03:22.476435900 CET	6780	50312	95.234.158.87	192.168.2.15
Nov 23, 2024 11:03:22.657764912 CET	6780	50312	95.234.158.87	192.168.2.15
Nov 23, 2024 11:03:22.657890081 CET	6780	50312	95.234.158.87	192.168.2.15
Nov 23, 2024 11:03:22.658157110 CET	50312	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:03:22.658157110 CET	50312	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:03:22.778326988 CET	6780	50312	95.234.158.87	192.168.2.15
Nov 23, 2024 11:03:27.659558058 CET	50314	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:03:27.779335976 CET	6780	50314	95.234.158.87	192.168.2.15
Nov 23, 2024 11:03:27.779417992 CET	50314	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:03:28.663443089 CET	50314	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:03:28.783473015 CET	6780	50314	95.234.158.87	192.168.2.15
Nov 23, 2024 11:03:28.958204031 CET	6780	50314	95.234.158.87	192.168.2.15
Nov 23, 2024 11:03:28.958265066 CET	50314	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:03:28.958332062 CET	50314	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:03:28.958379030 CET	6780	50314	95.234.158.87	192.168.2.15
Nov 23, 2024 11:03:28.958425999 CET	50314	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:03:29.078708887 CET	6780	50314	95.234.158.87	192.168.2.15
Nov 23, 2024 11:03:33.961396933 CET	50316	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:03:34.085525990 CET	6780	50316	95.234.158.87	192.168.2.15
Nov 23, 2024 11:03:34.085654974 CET	50316	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:03:34.966449976 CET	50316	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:03:35.087225914 CET	6780	50316	95.234.158.87	192.168.2.15
Nov 23, 2024 11:03:35.237971067 CET	6780	50316	95.234.158.87	192.168.2.15
Nov 23, 2024 11:03:35.238023043 CET	50316	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:03:35.238086939 CET	50316	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:03:35.238091946 CET	6780	50316	95.234.158.87	192.168.2.15
Nov 23, 2024 11:03:35.238122940 CET	50316	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:03:35.359069109 CET	6780	50316	95.234.158.87	192.168.2.15
Nov 23, 2024 11:03:40.239836931 CET	50318	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:03:40.359451056 CET	6780	50318	95.234.158.87	192.168.2.15
Nov 23, 2024 11:03:40.359586954 CET	50318	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:03:41.246330976 CET	50318	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:03:41.414496899 CET	6780	50318	95.234.158.87	192.168.2.15
Nov 23, 2024 11:03:41.538172960 CET	6780	50318	95.234.158.87	192.168.2.15
Nov 23, 2024 11:03:41.538224936 CET	50318	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:03:41.538265944 CET	50318	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:03:41.540066957 CET	6780	50318	95.234.158.87	192.168.2.15
Nov 23, 2024 11:03:41.540117025 CET	50318	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:03:41.661067963 CET	6780	50318	95.234.158.87	192.168.2.15
Nov 23, 2024 11:03:46.540020943 CET	50320	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:03:46.659734011 CET	6780	50320	95.234.158.87	192.168.2.15
Nov 23, 2024 11:03:46.659787893 CET	50320	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:03:47.544411898 CET	50320	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:03:47.664072990 CET	6780	50320	95.234.158.87	192.168.2.15
Nov 23, 2024 11:03:47.770298004 CET	6780	50320	95.234.158.87	192.168.2.15
Nov 23, 2024 11:03:47.770314932 CET	6780	50320	95.234.158.87	192.168.2.15
Nov 23, 2024 11:03:47.770351887 CET	50320	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:03:47.770406008 CET	50320	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:03:47.889908075 CET	6780	50320	95.234.158.87	192.168.2.15
Nov 23, 2024 11:03:52.772053957 CET	50322	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:03:52.892072916 CET	6780	50322	95.234.158.87	192.168.2.15
Nov 23, 2024 11:03:52.892124891 CET	50322	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:03:53.776344061 CET	50322	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:03:53.896296024 CET	6780	50322	95.234.158.87	192.168.2.15
Nov 23, 2024 11:03:54.026949883 CET	6780	50322	95.234.158.87	192.168.2.15
Nov 23, 2024 11:03:54.026983976 CET	6780	50322	95.234.158.87	192.168.2.15
Nov 23, 2024 11:03:54.027172089 CET	50322	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:03:54.027226925 CET	50322	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:03:54.146763086 CET	6780	50322	95.234.158.87	192.168.2.15
Nov 23, 2024 11:03:59.061573029 CET	50324	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:03:59.182934046 CET	6780	50324	95.234.158.87	192.168.2.15
Nov 23, 2024 11:03:59.182996035 CET	50324	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:04:00.066346884 CET	50324	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:04:00.234211922 CET	6780	50324	95.234.158.87	192.168.2.15
Nov 23, 2024 11:04:00.330672979 CET	6780	50324	95.234.158.87	192.168.2.15
Nov 23, 2024 11:04:00.330729008 CET	50324	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:04:00.330760956 CET	6780	50324	95.234.158.87	192.168.2.15
Nov 23, 2024 11:04:00.330782890 CET	50324	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:04:00.330852985 CET	50324	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:04:00.454561949 CET	6780	50324	95.234.158.87	192.168.2.15
Nov 23, 2024 11:04:05.332756996 CET	50326	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:04:05.452342987 CET	6780	50326	95.234.158.87	192.168.2.15
Nov 23, 2024 11:04:05.452420950 CET	50326	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:04:06.339140892 CET	50326	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:04:06.509434938 CET	6780	50326	95.234.158.87	192.168.2.15
Nov 23, 2024 11:04:06.553872108 CET	6780	50326	95.234.158.87	192.168.2.15
Nov 23, 2024 11:04:06.553925991 CET	50326	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:04:06.553982019 CET	50326	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:04:06.554017067 CET	6780	50326	95.234.158.87	192.168.2.15
Nov 23, 2024 11:04:06.554056883 CET	50326	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:04:06.751214027 CET	6780	50326	95.234.158.87	192.168.2.15
Nov 23, 2024 11:04:11.557096004 CET	50328	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:04:11.676780939 CET	6780	50328	95.234.158.87	192.168.2.15
Nov 23, 2024 11:04:11.676853895 CET	50328	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:04:12.562036991 CET	50328	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:04:12.682255030 CET	6780	50328	95.234.158.87	192.168.2.15
Nov 23, 2024 11:04:12.920135975 CET	6780	50328	95.234.158.87	192.168.2.15
Nov 23, 2024 11:04:12.920296907 CET	50328	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:04:13.040626049 CET	6780	50328	95.234.158.87	192.168.2.15
Nov 23, 2024 11:04:13.040664911 CET	6780	50328	95.234.158.87	192.168.2.15
Nov 23, 2024 11:04:13.040688992 CET	50328	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:04:13.041074038 CET	50328	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:04:13.160660028 CET	6780	50328	95.234.158.87	192.168.2.15
Nov 23, 2024 11:04:18.043258905 CET	50330	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:04:18.162873983 CET	6780	50330	95.234.158.87	192.168.2.15
Nov 23, 2024 11:04:18.162935972 CET	50330	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:04:19.050350904 CET	50330	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:04:19.171041965 CET	6780	50330	95.234.158.87	192.168.2.15
Nov 23, 2024 11:04:19.314368010 CET	6780	50330	95.234.158.87	192.168.2.15
Nov 23, 2024 11:04:19.314419985 CET	50330	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:04:19.314456940 CET	50330	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:04:19.314486027 CET	6780	50330	95.234.158.87	192.168.2.15
Nov 23, 2024 11:04:19.314534903 CET	50330	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:04:19.437211990 CET	6780	50330	95.234.158.87	192.168.2.15
Nov 23, 2024 11:04:24.316924095 CET	50332	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:04:24.437205076 CET	6780	50332	95.234.158.87	192.168.2.15
Nov 23, 2024 11:04:24.437262058 CET	50332	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:04:25.320878983 CET	50332	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:04:25.440366030 CET	6780	50332	95.234.158.87	192.168.2.15
Nov 23, 2024 11:04:25.597491980 CET	6780	50332	95.234.158.87	192.168.2.15
Nov 23, 2024 11:04:25.597543001 CET	50332	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:04:25.597598076 CET	50332	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:04:25.597635031 CET	6780	50332	95.234.158.87	192.168.2.15
Nov 23, 2024 11:04:25.597666025 CET	50332	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:04:25.718151093 CET	6780	50332	95.234.158.87	192.168.2.15
Nov 23, 2024 11:04:30.598947048 CET	50334	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:04:30.718738079 CET	6780	50334	95.234.158.87	192.168.2.15
Nov 23, 2024 11:04:30.718801022 CET	50334	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:04:31.602386951 CET	50334	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:04:31.722088099 CET	6780	50334	95.234.158.87	192.168.2.15
Nov 23, 2024 11:04:31.832799911 CET	6780	50334	95.234.158.87	192.168.2.15
Nov 23, 2024 11:04:31.833030939 CET	6780	50334	95.234.158.87	192.168.2.15
Nov 23, 2024 11:04:31.833091021 CET	50334	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:04:31.833091021 CET	50334	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:04:31.833091021 CET	50334	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:04:31.952790022 CET	6780	50334	95.234.158.87	192.168.2.15
Nov 23, 2024 11:04:36.834845066 CET	50336	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:04:36.954565048 CET	6780	50336	95.234.158.87	192.168.2.15
Nov 23, 2024 11:04:36.954653025 CET	50336	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:04:37.839603901 CET	50336	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:04:37.959235907 CET	6780	50336	95.234.158.87	192.168.2.15
Nov 23, 2024 11:04:38.122915030 CET	6780	50336	95.234.158.87	192.168.2.15
Nov 23, 2024 11:04:38.122965097 CET	50336	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:04:38.123023033 CET	50336	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:04:38.123094082 CET	6780	50336	95.234.158.87	192.168.2.15
Nov 23, 2024 11:04:38.123131037 CET	50336	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:04:38.249574900 CET	6780	50336	95.234.158.87	192.168.2.15
Nov 23, 2024 11:04:43.124722004 CET	50338	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:04:43.244254112 CET	6780	50338	95.234.158.87	192.168.2.15
Nov 23, 2024 11:04:43.244318008 CET	50338	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:04:43.488812923 CET	6780	50338	95.234.158.87	192.168.2.15
Nov 23, 2024 11:04:43.492213964 CET	50338	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:04:44.128695011 CET	50338	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:04:44.160820007 CET	50338	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:04:44.186784983 CET	50338	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:04:44.212898970 CET	50338	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:04:44.239877939 CET	50338	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:04:44.248200893 CET	6780	50338	95.234.158.87	192.168.2.15
Nov 23, 2024 11:04:44.249433994 CET	50340	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:04:44.280354977 CET	6780	50338	95.234.158.87	192.168.2.15
Nov 23, 2024 11:04:44.306253910 CET	6780	50338	95.234.158.87	192.168.2.15
Nov 23, 2024 11:04:44.333143950 CET	6780	50338	95.234.158.87	192.168.2.15
Nov 23, 2024 11:04:44.359349966 CET	6780	50338	95.234.158.87	192.168.2.15
Nov 23, 2024 11:04:44.368942022 CET	6780	50340	95.234.158.87	192.168.2.15
Nov 23, 2024 11:04:44.369091034 CET	50340	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:04:45.252651930 CET	50340	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:04:45.372401953 CET	6780	50340	95.234.158.87	192.168.2.15
Nov 23, 2024 11:04:45.573570013 CET	6780	50340	95.234.158.87	192.168.2.15
Nov 23, 2024 11:04:45.573676109 CET	50340	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:04:45.573676109 CET	50340	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:04:45.573889971 CET	6780	50340	95.234.158.87	192.168.2.15
Nov 23, 2024 11:04:45.573934078 CET	50340	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:04:45.696446896 CET	6780	50340	95.234.158.87	192.168.2.15
Nov 23, 2024 11:04:50.575620890 CET	50342	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:04:50.696399927 CET	6780	50342	95.234.158.87	192.168.2.15
Nov 23, 2024 11:04:50.696475983 CET	50342	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:04:51.579185009 CET	50342	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:04:51.765516996 CET	6780	50342	95.234.158.87	192.168.2.15
Nov 23, 2024 11:04:51.846946955 CET	6780	50342	95.234.158.87	192.168.2.15
Nov 23, 2024 11:04:51.846991062 CET	50342	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:04:51.847033024 CET	6780	50342	95.234.158.87	192.168.2.15
Nov 23, 2024 11:04:51.847052097 CET	50342	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:04:51.847073078 CET	50342	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:04:51.966487885 CET	6780	50342	95.234.158.87	192.168.2.15
Nov 23, 2024 11:04:56.848779917 CET	50344	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:04:56.968966961 CET	6780	50344	95.234.158.87	192.168.2.15
Nov 23, 2024 11:04:56.969037056 CET	50344	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:04:57.852067947 CET	50344	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:04:57.974117041 CET	6780	50344	95.234.158.87	192.168.2.15
Nov 23, 2024 11:04:58.121601105 CET	6780	50344	95.234.158.87	192.168.2.15
Nov 23, 2024 11:04:58.121866941 CET	6780	50344	95.234.158.87	192.168.2.15
Nov 23, 2024 11:04:58.121903896 CET	50344	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:04:58.121903896 CET	50344	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:04:58.122039080 CET	50344	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:04:58.243174076 CET	6780	50344	95.234.158.87	192.168.2.15
Nov 23, 2024 11:05:03.123966932 CET	50346	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:05:03.244098902 CET	6780	50346	95.234.158.87	192.168.2.15
Nov 23, 2024 11:05:03.248718977 CET	50346	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:05:04.130016088 CET	50346	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:05:04.249856949 CET	6780	50346	95.234.158.87	192.168.2.15
Nov 23, 2024 11:05:04.376662016 CET	6780	50346	95.234.158.87	192.168.2.15
Nov 23, 2024 11:05:04.376720905 CET	50346	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:05:04.376729012 CET	6780	50346	95.234.158.87	192.168.2.15
Nov 23, 2024 11:05:04.376785994 CET	50346	6780	192.168.2.15	95.234.158.87
Nov 23, 2024 11:05:04.496246099 CET	6780	50346	95.234.158.87	192.168.2.15

IRC Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Nov 23, 2024 11:03:03.467048883 CET	50306	6780	192.168.2.15	95.234.158.87	NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa
Nov 23, 2024 11:03:09.697951078 CET	50308	6780	192.168.2.15	95.234.158.87	NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa
Nov 23, 2024 11:03:15.967644930 CET	50310	6780	192.168.2.15	95.234.158.87	NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa
Nov 23, 2024 11:03:22.356915951 CET	50312	6780	192.168.2.15	95.234.158.87	NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa
Nov 23, 2024 11:03:28.663443089 CET	50314	6780	192.168.2.15	95.234.158.87	NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa
Nov 23, 2024 11:03:34.966449976 CET	50316	6780	192.168.2.15	95.234.158.87	NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa
Nov 23, 2024 11:03:41.246330976 CET	50318	6780	192.168.2.15	95.234.158.87	NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa
Nov 23, 2024 11:03:47.544411898 CET	50320	6780	192.168.2.15	95.234.158.87	NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa
Nov 23, 2024 11:03:53.776344061 CET	50322	6780	192.168.2.15	95.234.158.87	NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa
Nov 23, 2024 11:04:00.066346884 CET	50324	6780	192.168.2.15	95.234.158.87	NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa
Nov 23, 2024 11:04:06.339140892 CET	50326	6780	192.168.2.15	95.234.158.87	NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa
Nov 23, 2024 11:04:12.562036991 CET	50328	6780	192.168.2.15	95.234.158.87	NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa
Nov 23, 2024 11:04:19.050350904 CET	50330	6780	192.168.2.15	95.234.158.87	NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa
Nov 23, 2024 11:04:25.320878983 CET	50332	6780	192.168.2.15	95.234.158.87	NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa
Nov 23, 2024 11:04:31.602386951 CET	50334	6780	192.168.2.15	95.234.158.87	NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa
Nov 23, 2024 11:04:37.839603901 CET	50336	6780	192.168.2.15	95.234.158.87	NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa
Nov 23, 2024 11:04:44.128695011 CET	50338	6780	192.168.2.15	95.234.158.87	NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa
Nov 23, 2024 11:04:44.160820007 CET	50338	6780	192.168.2.15	95.234.158.87	NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa
Nov 23, 2024 11:04:44.186784983 CET	50338	6780	192.168.2.15	95.234.158.87	NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa
Nov 23, 2024 11:04:44.212898970 CET	50338	6780	192.168.2.15	95.234.158.87	NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa
Nov 23, 2024 11:04:44.239877939 CET	50338	6780	192.168.2.15	95.234.158.87	NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa
Nov 23, 2024 11:04:45.252651930 CET	50340	6780	192.168.2.15	95.234.158.87	NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa
Nov 23, 2024 11:04:51.579185009 CET	50342	6780	192.168.2.15	95.234.158.87	NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa
Nov 23, 2024 11:04:57.852067947 CET	50344	6780	192.168.2.15	95.234.158.87	NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa
Nov 23, 2024 11:05:04.130016088 CET	50346	6780	192.168.2.15	95.234.158.87	NICK [OSX\|POWERPC]LOwa USER LOwa localhost localhost :LOwa

System Behavior

Analysis Process: yakuza.ppc.elf PID: 5527, Parent PID: 5446

General

Start time (UTC):	10:03:01
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	/tmp/yakuza.ppc.elf
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: yakuza.ppc.elf PID: 5529, Parent PID: 5527

General

Start time (UTC):	10:03:01
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: yakuza.ppc.elf PID: 5531, Parent PID: 5529

General

Start time (UTC):	10:03:01
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: yakuza.ppc.elf PID: 5533, Parent PID: 5529

General

Start time (UTC):	10:03:01
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: yakuza.ppc.elf PID: 5535, Parent PID: 5529

General

Start time (UTC):	10:03:01
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: sh PID: 5535, Parent PID: 5529

General

Start time (UTC):	10:03:01
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 902i13 \|\| busybox pkill -9 902i13"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5541, Parent PID: 5535

General

Start time (UTC):	10:03:01
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5541, Parent PID: 5535

General

Start time (UTC):	10:03:01
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 902i13
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5542, Parent PID: 5535

General

Start time (UTC):	10:03:03
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5542, Parent PID: 5535

General

Start time (UTC):	10:03:03
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 902i13
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.ppc.elf PID: 5545, Parent PID: 5529

General

Start time (UTC):	10:03:04
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: sh PID: 5545, Parent PID: 5529

General

Start time (UTC):	10:03:04
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 BzSxLxBxeY \|\| busybox pkill -9 BzSxLxBxeY"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5550, Parent PID: 5545

General

Start time (UTC):	10:03:04
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5550, Parent PID: 5545

General

Start time (UTC):	10:03:04
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 BzSxLxBxeY
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5551, Parent PID: 5545

General

Start time (UTC):	10:03:05
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5551, Parent PID: 5545

General

Start time (UTC):	10:03:05
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 BzSxLxBxeY
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.ppc.elf PID: 5552, Parent PID: 5529

General

Start time (UTC):	10:03:06
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: sh PID: 5552, Parent PID: 5529

General

Start time (UTC):	10:03:06
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 HOHO-LUGO7 \|\| busybox pkill -9 HOHO-LUGO7"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5557, Parent PID: 5552

General

Start time (UTC):	10:03:06
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5557, Parent PID: 5552

General

Start time (UTC):	10:03:06
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 HOHO-LUGO7
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5560, Parent PID: 5552

General

Start time (UTC):	10:03:08
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5560, Parent PID: 5552

General

Start time (UTC):	10:03:08
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 HOHO-LUGO7
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.ppc.elf PID: 5561, Parent PID: 5529

General

Start time (UTC):	10:03:09
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: sh PID: 5561, Parent PID: 5529

General

Start time (UTC):	10:03:09
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 HOHO-U79OL \|\| busybox pkill -9 HOHO-U79OL"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5566, Parent PID: 5561

General

Start time (UTC):	10:03:09
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5566, Parent PID: 5561

General

Start time (UTC):	10:03:09
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 HOHO-U79OL
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5567, Parent PID: 5561

General

Start time (UTC):	10:03:10
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5567, Parent PID: 5561

General

Start time (UTC):	10:03:10
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 HOHO-U79OL
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.ppc.elf PID: 5568, Parent PID: 5529

General

Start time (UTC):	10:03:11
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: sh PID: 5568, Parent PID: 5529

General

Start time (UTC):	10:03:11
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 JuYfouyf87 \|\| busybox pkill -9 JuYfouyf87"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5570, Parent PID: 5568

General

Start time (UTC):	10:03:11
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5570, Parent PID: 5568

General

Start time (UTC):	10:03:11
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 JuYfouyf87
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5573, Parent PID: 5568

General

Start time (UTC):	10:03:13
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5573, Parent PID: 5568

General

Start time (UTC):	10:03:13
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 JuYfouyf87
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.ppc.elf PID: 5574, Parent PID: 5529

General

Start time (UTC):	10:03:14
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: sh PID: 5574, Parent PID: 5529

General

Start time (UTC):	10:03:14
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 NiGGeR69xd \|\| busybox pkill -9 NiGGeR69xd"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5576, Parent PID: 5574

General

Start time (UTC):	10:03:14
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5576, Parent PID: 5574

General

Start time (UTC):	10:03:14
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 NiGGeR69xd
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5577, Parent PID: 5574

General

Start time (UTC):	10:03:15
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5577, Parent PID: 5574

General

Start time (UTC):	10:03:15
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 NiGGeR69xd
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.ppc.elf PID: 5578, Parent PID: 5529

General

Start time (UTC):	10:03:16
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: sh PID: 5578, Parent PID: 5529

General

Start time (UTC):	10:03:16
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 SO190Ij1X \|\| busybox pkill -9 SO190Ij1X"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5584, Parent PID: 5578

General

Start time (UTC):	10:03:16
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5584, Parent PID: 5578

General

Start time (UTC):	10:03:16
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 SO190Ij1X
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5587, Parent PID: 5578

General

Start time (UTC):	10:03:18
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5587, Parent PID: 5578

General

Start time (UTC):	10:03:18
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 SO190Ij1X
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.ppc.elf PID: 5588, Parent PID: 5529

General

Start time (UTC):	10:03:19
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: sh PID: 5588, Parent PID: 5529

General

Start time (UTC):	10:03:19
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 LOLKIKEEEDDE \|\| busybox pkill -9 LOLKIKEEEDDE"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5590, Parent PID: 5588

General

Start time (UTC):	10:03:19
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5590, Parent PID: 5588

General

Start time (UTC):	10:03:19
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 LOLKIKEEEDDE
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5610, Parent PID: 5588

General

Start time (UTC):	10:03:21
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5610, Parent PID: 5588

General

Start time (UTC):	10:03:21
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 LOLKIKEEEDDE
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.ppc.elf PID: 5611, Parent PID: 5529

General

Start time (UTC):	10:03:22
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: sh PID: 5611, Parent PID: 5529

General

Start time (UTC):	10:03:22
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 ekjheory98e \|\| busybox pkill -9 ekjheory98e"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5616, Parent PID: 5611

General

Start time (UTC):	10:03:22
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5616, Parent PID: 5611

General

Start time (UTC):	10:03:22
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 ekjheory98e
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5619, Parent PID: 5611

General

Start time (UTC):	10:03:24
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5619, Parent PID: 5611

General

Start time (UTC):	10:03:24
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 ekjheory98e
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.ppc.elf PID: 5620, Parent PID: 5529

General

Start time (UTC):	10:03:25
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: sh PID: 5620, Parent PID: 5529

General

Start time (UTC):	10:03:25
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 scansh4 \|\| busybox pkill -9 scansh4"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5622, Parent PID: 5620

General

Start time (UTC):	10:03:25
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5622, Parent PID: 5620

General

Start time (UTC):	10:03:25
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 scansh4
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5623, Parent PID: 5620

General

Start time (UTC):	10:03:26
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5623, Parent PID: 5620

General

Start time (UTC):	10:03:26
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 scansh4
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.ppc.elf PID: 5624, Parent PID: 5529

General

Start time (UTC):	10:03:27
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: sh PID: 5624, Parent PID: 5529

General

Start time (UTC):	10:03:27
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 MDMA \|\| busybox pkill -9 MDMA"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5626, Parent PID: 5624

General

Start time (UTC):	10:03:27
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5626, Parent PID: 5624

General

Start time (UTC):	10:03:27
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 MDMA
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5630, Parent PID: 5624

General

Start time (UTC):	10:03:29
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5630, Parent PID: 5624

General

Start time (UTC):	10:03:29
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 MDMA
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.ppc.elf PID: 5631, Parent PID: 5529

General

Start time (UTC):	10:03:30
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: sh PID: 5631, Parent PID: 5529

General

Start time (UTC):	10:03:30
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 fdevalvex \|\| busybox pkill -9 fdevalvex"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5637, Parent PID: 5631

General

Start time (UTC):	10:03:30
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5637, Parent PID: 5631

General

Start time (UTC):	10:03:30
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 fdevalvex
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5638, Parent PID: 5631

General

Start time (UTC):	10:03:31
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5638, Parent PID: 5631

General

Start time (UTC):	10:03:31
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 fdevalvex
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.ppc.elf PID: 5639, Parent PID: 5529

General

Start time (UTC):	10:03:32
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: sh PID: 5639, Parent PID: 5529

General

Start time (UTC):	10:03:32
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 scanspc \|\| busybox pkill -9 scanspc"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5644, Parent PID: 5639

General

Start time (UTC):	10:03:32
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5644, Parent PID: 5639

General

Start time (UTC):	10:03:32
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 scanspc
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5647, Parent PID: 5639

General

Start time (UTC):	10:03:34
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5647, Parent PID: 5639

General

Start time (UTC):	10:03:34
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 scanspc
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.ppc.elf PID: 5648, Parent PID: 5529

General

Start time (UTC):	10:03:35
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: sh PID: 5648, Parent PID: 5529

General

Start time (UTC):	10:03:35
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 MELTEDNINJAREALZ \|\| busybox pkill -9 MELTEDNINJAREALZ"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5653, Parent PID: 5648

General

Start time (UTC):	10:03:35
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5653, Parent PID: 5648

General

Start time (UTC):	10:03:35
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 MELTEDNINJAREALZ
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5654, Parent PID: 5648

General

Start time (UTC):	10:03:36
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5654, Parent PID: 5648

General

Start time (UTC):	10:03:36
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 MELTEDNINJAREALZ
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.ppc.elf PID: 5655, Parent PID: 5529

General

Start time (UTC):	10:03:37
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: sh PID: 5655, Parent PID: 5529

General

Start time (UTC):	10:03:37
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 flexsonskids \|\| busybox pkill -9 flexsonskids"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5659, Parent PID: 5655

General

Start time (UTC):	10:03:37
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5659, Parent PID: 5655

General

Start time (UTC):	10:03:37
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 flexsonskids
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5663, Parent PID: 5655

General

Start time (UTC):	10:03:39
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5663, Parent PID: 5655

General

Start time (UTC):	10:03:39
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 flexsonskids
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 5664, Parent PID: 5529

General

Start time (UTC):	10:03:40
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 5664, Parent PID: 5529

General

Start time (UTC):	10:03:40
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 scanx86 \|\| busybox pkill -9 scanx86"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5669, Parent PID: 5664

General

Start time (UTC):	10:03:40
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5669, Parent PID: 5664

General

Start time (UTC):	10:03:40
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 scanx86
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5670, Parent PID: 5664

General

Start time (UTC):	10:03:41
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5670, Parent PID: 5664

General

Start time (UTC):	10:03:41
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 scanx86
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 5671, Parent PID: 5529

General

Start time (UTC):	10:03:42
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 5671, Parent PID: 5529

General

Start time (UTC):	10:03:42
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 MISAKI-U79OL \|\| busybox pkill -9 MISAKI-U79OL"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5673, Parent PID: 5671

General

Start time (UTC):	10:03:42
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5673, Parent PID: 5671

General

Start time (UTC):	10:03:42
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 MISAKI-U79OL
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5676, Parent PID: 5671

General

Start time (UTC):	10:03:44
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5676, Parent PID: 5671

General

Start time (UTC):	10:03:44
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 MISAKI-U79OL
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 5677, Parent PID: 5529

General

Start time (UTC):	10:03:45
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 5677, Parent PID: 5529

General

Start time (UTC):	10:03:45
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 foAxi102kxe \|\| busybox pkill -9 foAxi102kxe"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5679, Parent PID: 5677

General

Start time (UTC):	10:03:45
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5679, Parent PID: 5677

General

Start time (UTC):	10:03:45
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 foAxi102kxe
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5680, Parent PID: 5677

General

Start time (UTC):	10:03:47
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5680, Parent PID: 5677

General

Start time (UTC):	10:03:47
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 foAxi102kxe
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 5681, Parent PID: 5529

General

Start time (UTC):	10:03:48
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 5681, Parent PID: 5529

General

Start time (UTC):	10:03:48
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 swodjwodjwoj \|\| busybox pkill -9 swodjwodjwoj"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5689, Parent PID: 5681

General

Start time (UTC):	10:03:48
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5689, Parent PID: 5681

General

Start time (UTC):	10:03:48
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 swodjwodjwoj
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5690, Parent PID: 5681

General

Start time (UTC):	10:03:49
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5690, Parent PID: 5681

General

Start time (UTC):	10:03:49
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 swodjwodjwoj
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 5691, Parent PID: 5529

General

Start time (UTC):	10:03:50
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 5691, Parent PID: 5529

General

Start time (UTC):	10:03:50
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 MmKiy7f87l \|\| busybox pkill -9 MmKiy7f87l"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5696, Parent PID: 5691

General

Start time (UTC):	10:03:50
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5696, Parent PID: 5691

General

Start time (UTC):	10:03:50
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 MmKiy7f87l
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5699, Parent PID: 5691

General

Start time (UTC):	10:03:52
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5699, Parent PID: 5691

General

Start time (UTC):	10:03:52
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 MmKiy7f87l
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 5700, Parent PID: 5529

General

Start time (UTC):	10:03:53
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 5700, Parent PID: 5529

General

Start time (UTC):	10:03:53
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 freecookiex86 \|\| busybox pkill -9 freecookiex86"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5707, Parent PID: 5700

General

Start time (UTC):	10:03:53
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5707, Parent PID: 5700

General

Start time (UTC):	10:03:53
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 freecookiex86
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5708, Parent PID: 5700

General

Start time (UTC):	10:03:54
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5708, Parent PID: 5700

General

Start time (UTC):	10:03:54
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 freecookiex86
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 5709, Parent PID: 5529

General

Start time (UTC):	10:03:55
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 5709, Parent PID: 5529

General

Start time (UTC):	10:03:55
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 sysgpu \|\| busybox pkill -9 sysgpu"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5714, Parent PID: 5709

General

Start time (UTC):	10:03:55
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5714, Parent PID: 5709

General

Start time (UTC):	10:03:55
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 sysgpu
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5715, Parent PID: 5709

General

Start time (UTC):	10:03:56
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5715, Parent PID: 5709

General

Start time (UTC):	10:03:56
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 sysgpu
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 5716, Parent PID: 5529

General

Start time (UTC):	10:03:57
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 5716, Parent PID: 5529

General

Start time (UTC):	10:03:57
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 NiGGeR69xd \|\| busybox pkill -9 NiGGeR69xd"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5718, Parent PID: 5716

General

Start time (UTC):	10:03:57
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5718, Parent PID: 5716

General

Start time (UTC):	10:03:57
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 NiGGeR69xd
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5722, Parent PID: 5716

General

Start time (UTC):	10:03:59
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5722, Parent PID: 5716

General

Start time (UTC):	10:03:59
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 NiGGeR69xd
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 5723, Parent PID: 5529

General

Start time (UTC):	10:04:00
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 5723, Parent PID: 5529

General

Start time (UTC):	10:04:00
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 frgege \|\| busybox pkill -9 frgege"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5729, Parent PID: 5723

General

Start time (UTC):	10:04:00
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5729, Parent PID: 5723

General

Start time (UTC):	10:04:00
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 frgege
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5730, Parent PID: 5723

General

Start time (UTC):	10:04:01
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5730, Parent PID: 5723

General

Start time (UTC):	10:04:01
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 frgege
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 5731, Parent PID: 5529

General

Start time (UTC):	10:04:02
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 5731, Parent PID: 5529

General

Start time (UTC):	10:04:02
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 sysupdater \|\| busybox pkill -9 sysupdater"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5733, Parent PID: 5731

General

Start time (UTC):	10:04:02
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5733, Parent PID: 5731

General

Start time (UTC):	10:04:02
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 sysupdater
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5736, Parent PID: 5731

General

Start time (UTC):	10:04:03
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5736, Parent PID: 5731

General

Start time (UTC):	10:04:03
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 sysupdater
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 5737, Parent PID: 5529

General

Start time (UTC):	10:04:04
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 5737, Parent PID: 5529

General

Start time (UTC):	10:04:04
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 0DnAzepd \|\| busybox pkill -9 0DnAzepd"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5739, Parent PID: 5737

General

Start time (UTC):	10:04:04
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5739, Parent PID: 5737

General

Start time (UTC):	10:04:04
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 0DnAzepd
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5740, Parent PID: 5737

General

Start time (UTC):	10:04:06
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5740, Parent PID: 5737

General

Start time (UTC):	10:04:06
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 0DnAzepd
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 5741, Parent PID: 5529

General

Start time (UTC):	10:04:07
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 5741, Parent PID: 5529

General

Start time (UTC):	10:04:07
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 NiGGeRD0nks69 \|\| busybox pkill -9 NiGGeRD0nks69"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5746, Parent PID: 5741

General

Start time (UTC):	10:04:07
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5746, Parent PID: 5741

General

Start time (UTC):	10:04:07
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 NiGGeRD0nks69
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5749, Parent PID: 5741

General

Start time (UTC):	10:04:08
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5749, Parent PID: 5741

General

Start time (UTC):	10:04:08
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 NiGGeRD0nks69
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 5750, Parent PID: 5529

General

Start time (UTC):	10:04:09
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 5750, Parent PID: 5529

General

Start time (UTC):	10:04:09
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 frgreu \|\| busybox pkill -9 frgreu"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5752, Parent PID: 5750

General

Start time (UTC):	10:04:09
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5752, Parent PID: 5750

General

Start time (UTC):	10:04:09
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 frgreu
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5753, Parent PID: 5750

General

Start time (UTC):	10:04:10
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5753, Parent PID: 5750

General

Start time (UTC):	10:04:10
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 frgreu
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 5754, Parent PID: 5529

General

Start time (UTC):	10:04:11
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 5754, Parent PID: 5529

General

Start time (UTC):	10:04:11
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 telnetd \|\| busybox pkill -9 telnetd"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5756, Parent PID: 5754

General

Start time (UTC):	10:04:11
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5756, Parent PID: 5754

General

Start time (UTC):	10:04:11
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 telnetd
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5759, Parent PID: 5754

General

Start time (UTC):	10:04:13
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5759, Parent PID: 5754

General

Start time (UTC):	10:04:13
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 telnetd
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 5760, Parent PID: 5529

General

Start time (UTC):	10:04:14
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 5760, Parent PID: 5529

General

Start time (UTC):	10:04:14
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 0x766f6964 \|\| busybox pkill -9 0x766f6964"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5762, Parent PID: 5760

General

Start time (UTC):	10:04:14
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5762, Parent PID: 5760

General

Start time (UTC):	10:04:14
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 0x766f6964
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5763, Parent PID: 5760

General

Start time (UTC):	10:04:15
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5763, Parent PID: 5760

General

Start time (UTC):	10:04:15
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 0x766f6964
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 5764, Parent PID: 5529

General

Start time (UTC):	10:04:16
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 5764, Parent PID: 5529

General

Start time (UTC):	10:04:16
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 NiGGeRd0nks1337 \|\| busybox pkill -9 NiGGeRd0nks1337"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5766, Parent PID: 5764

General

Start time (UTC):	10:04:17
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5766, Parent PID: 5764

General

Start time (UTC):	10:04:17
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 NiGGeRd0nks1337
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5769, Parent PID: 5764

General

Start time (UTC):	10:04:18
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5769, Parent PID: 5764

General

Start time (UTC):	10:04:18
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 NiGGeRd0nks1337
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 5770, Parent PID: 5529

General

Start time (UTC):	10:04:19
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 5770, Parent PID: 5529

General

Start time (UTC):	10:04:19
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 gaft \|\| busybox pkill -9 gaft"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5772, Parent PID: 5770

General

Start time (UTC):	10:04:19
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5772, Parent PID: 5770

General

Start time (UTC):	10:04:19
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 gaft
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5773, Parent PID: 5770

General

Start time (UTC):	10:04:21
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5773, Parent PID: 5770

General

Start time (UTC):	10:04:21
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 gaft
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 5774, Parent PID: 5529

General

Start time (UTC):	10:04:22
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 5774, Parent PID: 5529

General

Start time (UTC):	10:04:22
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 urasgbsigboa \|\| busybox pkill -9 urasgbsigboa"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5780, Parent PID: 5774

General

Start time (UTC):	10:04:22
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5780, Parent PID: 5774

General

Start time (UTC):	10:04:22
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 urasgbsigboa
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5783, Parent PID: 5774

General

Start time (UTC):	10:04:23
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5783, Parent PID: 5774

General

Start time (UTC):	10:04:23
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 urasgbsigboa
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 5784, Parent PID: 5529

General

Start time (UTC):	10:04:24
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 5784, Parent PID: 5529

General

Start time (UTC):	10:04:24
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 120i3UI49 \|\| busybox pkill -9 120i3UI49"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5786, Parent PID: 5784

General

Start time (UTC):	10:04:24
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5786, Parent PID: 5784

General

Start time (UTC):	10:04:24
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 120i3UI49
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5787, Parent PID: 5784

General

Start time (UTC):	10:04:26
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5787, Parent PID: 5784

General

Start time (UTC):	10:04:26
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 120i3UI49
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 5788, Parent PID: 5529

General

Start time (UTC):	10:04:27
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 5788, Parent PID: 5529

General

Start time (UTC):	10:04:27
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 OaF3 \|\| busybox pkill -9 OaF3"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5794, Parent PID: 5788

General

Start time (UTC):	10:04:27
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5794, Parent PID: 5788

General

Start time (UTC):	10:04:27
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 OaF3
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5798, Parent PID: 5788

General

Start time (UTC):	10:04:28
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5798, Parent PID: 5788

General

Start time (UTC):	10:04:28
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 OaF3
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 5799, Parent PID: 5529

General

Start time (UTC):	10:04:29
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 5799, Parent PID: 5529

General

Start time (UTC):	10:04:29
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 geae \|\| busybox pkill -9 geae"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5803, Parent PID: 5799

General

Start time (UTC):	10:04:29
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5803, Parent PID: 5799

General

Start time (UTC):	10:04:29
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 geae
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5805, Parent PID: 5799

General

Start time (UTC):	10:04:30
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5805, Parent PID: 5799

General

Start time (UTC):	10:04:30
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 geae
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 5806, Parent PID: 5529

General

Start time (UTC):	10:04:31
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 5806, Parent PID: 5529

General

Start time (UTC):	10:04:31
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 vaiolmao \|\| busybox pkill -9 vaiolmao"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5808, Parent PID: 5806

General

Start time (UTC):	10:04:31
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5808, Parent PID: 5806

General

Start time (UTC):	10:04:31
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 vaiolmao
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5809, Parent PID: 5806

General

Start time (UTC):	10:04:32
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5809, Parent PID: 5806

General

Start time (UTC):	10:04:32
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 vaiolmao
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 5812, Parent PID: 5529

General

Start time (UTC):	10:04:33
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 5812, Parent PID: 5529

General

Start time (UTC):	10:04:33
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 123123a \|\| busybox pkill -9 123123a"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5814, Parent PID: 5812

General

Start time (UTC):	10:04:33
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5814, Parent PID: 5812

General

Start time (UTC):	10:04:33
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 123123a
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5815, Parent PID: 5812

General

Start time (UTC):	10:04:35
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5815, Parent PID: 5812

General

Start time (UTC):	10:04:35
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 123123a
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 5816, Parent PID: 5529

General

Start time (UTC):	10:04:36
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 5816, Parent PID: 5529

General

Start time (UTC):	10:04:36
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 Ofurain0n4H34D \|\| busybox pkill -9 Ofurain0n4H34D"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5821, Parent PID: 5816

General

Start time (UTC):	10:04:36
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5821, Parent PID: 5816

General

Start time (UTC):	10:04:36
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 Ofurain0n4H34D
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5822, Parent PID: 5816

General

Start time (UTC):	10:04:37
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5822, Parent PID: 5816

General

Start time (UTC):	10:04:37
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 Ofurain0n4H34D
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 5825, Parent PID: 5529

General

Start time (UTC):	10:04:38
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 5825, Parent PID: 5529

General

Start time (UTC):	10:04:38
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 ggTrex \|\| busybox pkill -9 ggTrex"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5827, Parent PID: 5825

General

Start time (UTC):	10:04:38
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5827, Parent PID: 5825

General

Start time (UTC):	10:04:38
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 ggTrex
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5828, Parent PID: 5825

General

Start time (UTC):	10:04:40
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5828, Parent PID: 5825

General

Start time (UTC):	10:04:40
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 ggTrex
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 5829, Parent PID: 5529

General

Start time (UTC):	10:04:41
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 5829, Parent PID: 5529

General

Start time (UTC):	10:04:41
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 wasads \|\| busybox pkill -9 wasads"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5831, Parent PID: 5829

General

Start time (UTC):	10:04:41
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5831, Parent PID: 5829

General

Start time (UTC):	10:04:41
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 wasads
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5832, Parent PID: 5829

General

Start time (UTC):	10:04:42
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5832, Parent PID: 5829

General

Start time (UTC):	10:04:42
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 wasads
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 5835, Parent PID: 5529

General

Start time (UTC):	10:04:43
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 5835, Parent PID: 5529

General

Start time (UTC):	10:04:43
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 1293194hjXD \|\| busybox pkill -9 1293194hjXD"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5841, Parent PID: 5835

General

Start time (UTC):	10:04:43
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5841, Parent PID: 5835

General

Start time (UTC):	10:04:43
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 1293194hjXD
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5842, Parent PID: 5835

General

Start time (UTC):	10:04:44
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5842, Parent PID: 5835

General

Start time (UTC):	10:04:44
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 1293194hjXD
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 5843, Parent PID: 5529

General

Start time (UTC):	10:04:45
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 5843, Parent PID: 5529

General

Start time (UTC):	10:04:45
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 OthLaLosn \|\| busybox pkill -9 OthLaLosn"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5845, Parent PID: 5843

General

Start time (UTC):	10:04:45
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5845, Parent PID: 5843

General

Start time (UTC):	10:04:45
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 OthLaLosn
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5846, Parent PID: 5843

General

Start time (UTC):	10:04:46
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5846, Parent PID: 5843

General

Start time (UTC):	10:04:46
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 OthLaLosn
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 5847, Parent PID: 5529

General

Start time (UTC):	10:04:47
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 5847, Parent PID: 5529

General

Start time (UTC):	10:04:47
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 ggt \|\| busybox pkill -9 ggt"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5849, Parent PID: 5847

General

Start time (UTC):	10:04:47
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5849, Parent PID: 5847

General

Start time (UTC):	10:04:47
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 ggt
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5852, Parent PID: 5847

General

Start time (UTC):	10:04:49
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5852, Parent PID: 5847

General

Start time (UTC):	10:04:49
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 ggt
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 5853, Parent PID: 5529

General

Start time (UTC):	10:04:50
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 5853, Parent PID: 5529

General

Start time (UTC):	10:04:50
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 wget-log \|\| busybox pkill -9 wget-log"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5858, Parent PID: 5853

General

Start time (UTC):	10:04:50
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5858, Parent PID: 5853

General

Start time (UTC):	10:04:50
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 wget-log
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5861, Parent PID: 5853

General

Start time (UTC):	10:04:51
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5861, Parent PID: 5853

General

Start time (UTC):	10:04:51
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 wget-log
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 5862, Parent PID: 5529

General

Start time (UTC):	10:04:52
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 5862, Parent PID: 5529

General

Start time (UTC):	10:04:52
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 1337SoraLOADER \|\| busybox pkill -9 1337SoraLOADER"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5864, Parent PID: 5862

General

Start time (UTC):	10:04:52
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5864, Parent PID: 5862

General

Start time (UTC):	10:04:52
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 1337SoraLOADER
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5867, Parent PID: 5862

General

Start time (UTC):	10:04:54
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5867, Parent PID: 5862

General

Start time (UTC):	10:04:54
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 1337SoraLOADER
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 5868, Parent PID: 5529

General

Start time (UTC):	10:04:55
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 5868, Parent PID: 5529

General

Start time (UTC):	10:04:55
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 SAIAKINA \|\| busybox pkill -9 SAIAKINA"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5873, Parent PID: 5868

General

Start time (UTC):	10:04:55
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5873, Parent PID: 5868

General

Start time (UTC):	10:04:55
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 SAIAKINA
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5874, Parent PID: 5868

General

Start time (UTC):	10:04:56
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5874, Parent PID: 5868

General

Start time (UTC):	10:04:56
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 SAIAKINA
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 5875, Parent PID: 5529

General

Start time (UTC):	10:04:57
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 5875, Parent PID: 5529

General

Start time (UTC):	10:04:57
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 ggtq \|\| busybox pkill -9 ggtq"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5881, Parent PID: 5875

General

Start time (UTC):	10:04:57
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5881, Parent PID: 5875

General

Start time (UTC):	10:04:57
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 ggtq
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5885, Parent PID: 5875

General

Start time (UTC):	10:04:58
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5885, Parent PID: 5875

General

Start time (UTC):	10:04:58
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 ggtq
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 5886, Parent PID: 5529

General

Start time (UTC):	10:04:59
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 5886, Parent PID: 5529

General

Start time (UTC):	10:04:59
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 1378bfp919GRB1Q2 \|\| busybox pkill -9 1378bfp919GRB1Q2"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5888, Parent PID: 5886

General

Start time (UTC):	10:04:59
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5888, Parent PID: 5886

General

Start time (UTC):	10:04:59
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 1378bfp919GRB1Q2
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5889, Parent PID: 5886

General

Start time (UTC):	10:05:01
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5889, Parent PID: 5886

General

Start time (UTC):	10:05:01
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 1378bfp919GRB1Q2
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 5890, Parent PID: 5529

General

Start time (UTC):	10:05:02
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 5890, Parent PID: 5529

General

Start time (UTC):	10:05:02
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 SAIAKUSO \|\| busybox pkill -9 SAIAKUSO"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5895, Parent PID: 5890

General

Start time (UTC):	10:05:02
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5895, Parent PID: 5890

General

Start time (UTC):	10:05:02
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 SAIAKUSO
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5898, Parent PID: 5890

General

Start time (UTC):	10:05:03
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5898, Parent PID: 5890

General

Start time (UTC):	10:05:03
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 SAIAKUSO
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 5899, Parent PID: 5529

General

Start time (UTC):	10:05:04
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 5899, Parent PID: 5529

General

Start time (UTC):	10:05:04
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 ggtr \|\| busybox pkill -9 ggtr"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5901, Parent PID: 5899

General

Start time (UTC):	10:05:04
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5901, Parent PID: 5899

General

Start time (UTC):	10:05:04
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 ggtr
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5902, Parent PID: 5899

General

Start time (UTC):	10:05:06
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5902, Parent PID: 5899

General

Start time (UTC):	10:05:06
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 ggtr
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained. Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism. Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes.
Tactics:	Credential Access
Data Sources:	Application Log: Application Log Content, Command: Command Execution, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report yakuza.ppc.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Network Port Distribution

TCP Packets

IRC Packets

System Behavior

Analysis Process: yakuza.ppc.elf PID: 5527, Parent PID: 5446

General

Chronological Activities

Analysis Process: yakuza.ppc.elf PID: 5529, Parent PID: 5527

General

Chronological Activities

Analysis Process: yakuza.ppc.elf PID: 5531, Parent PID: 5529

General

Chronological Activities

Analysis Process: yakuza.ppc.elf PID: 5533, Parent PID: 5529

General

Chronological Activities

Analysis Process: yakuza.ppc.elf PID: 5535, Parent PID: 5529

General

Linux Analysis Report
yakuza.ppc.elf