Edit tour

Linux Analysis Report
yakuza.x86.elf

Overview

General Information

Sample name:	yakuza.x86.elf
Analysis ID:	1561405
MD5:	86ae7faf59555791f91c85614824d7fc
SHA1:	77182d8944b2d96bd8f7e50e6a056c23f6be0127
SHA256:	e801f5c7f5b523fd52eff6502bb1805bced37cb26f77f36d8de0df2e9a8e78e0
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	76
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Machine Learning detection for sample

Uses IRC for communication with a C&C

Uses known network protocols on non-standard ports

Detected TCP or UDP traffic on non-standard ports

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "kill" or "pkill" command typically used to terminate processes

Reads CPU information from /sys indicative of miner or evasive malware

Sample and/or dropped files contains symbols with suspicious names

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample contains strings indicative of password brute-forcing capabilities

Sample contains strings that are user agent strings indicative of HTTP manipulation

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1561405
Start date and time:	2024-11-23 11:06:11 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	yakuza.x86.elf
Detection:	MAL
Classification:	mal76.troj.linELF@0/0@0/0

Warnings

Report size exceeded maximum capacity and may have missing behavior information.

Runtime Messages

Command:	/tmp/yakuza.x86.elf
PID:	5537
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	CAPSAICIN
Standard Error:

Process Tree

system is lnxubuntu20

yakuza.x86.elf (PID: 5537, Parent: 5458, MD5: 86ae7faf59555791f91c85614824d7fc) Arguments: /tmp/yakuza.x86.elf

yakuza.x86.elf New Fork (PID: 5538, Parent: 5537)

yakuza.x86.elf New Fork (PID: 5539, Parent: 5538)

yakuza.x86.elf New Fork (PID: 5540, Parent: 5538)

yakuza.x86.elf New Fork (PID: 5541, Parent: 5538)

sh (PID: 5541, Parent: 5538, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 902i13 || busybox pkill -9 902i13"

sh New Fork (PID: 5542, Parent: 5541)

pkill (PID: 5542, Parent: 5541, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 902i13

sh New Fork (PID: 5543, Parent: 5541)

busybox (PID: 5543, Parent: 5541, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 902i13

yakuza.x86.elf New Fork (PID: 5546, Parent: 5538)

sh (PID: 5546, Parent: 5538, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 BzSxLxBxeY || busybox pkill -9 BzSxLxBxeY"

sh New Fork (PID: 5547, Parent: 5546)

pkill (PID: 5547, Parent: 5546, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 BzSxLxBxeY

sh New Fork (PID: 5548, Parent: 5546)

busybox (PID: 5548, Parent: 5546, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 BzSxLxBxeY

yakuza.x86.elf New Fork (PID: 5549, Parent: 5538)

sh (PID: 5549, Parent: 5538, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 HOHO-LUGO7 || busybox pkill -9 HOHO-LUGO7"

sh New Fork (PID: 5550, Parent: 5549)

pkill (PID: 5550, Parent: 5549, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 HOHO-LUGO7

sh New Fork (PID: 5551, Parent: 5549)

busybox (PID: 5551, Parent: 5549, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 HOHO-LUGO7

yakuza.x86.elf New Fork (PID: 5554, Parent: 5538)

sh (PID: 5554, Parent: 5538, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 HOHO-U79OL || busybox pkill -9 HOHO-U79OL"

sh New Fork (PID: 5555, Parent: 5554)

pkill (PID: 5555, Parent: 5554, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 HOHO-U79OL

sh New Fork (PID: 5556, Parent: 5554)

busybox (PID: 5556, Parent: 5554, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 HOHO-U79OL

yakuza.x86.elf New Fork (PID: 5557, Parent: 5538)

sh (PID: 5557, Parent: 5538, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 JuYfouyf87 || busybox pkill -9 JuYfouyf87"

sh New Fork (PID: 5558, Parent: 5557)

pkill (PID: 5558, Parent: 5557, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 JuYfouyf87

sh New Fork (PID: 5559, Parent: 5557)

busybox (PID: 5559, Parent: 5557, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 JuYfouyf87

yakuza.x86.elf New Fork (PID: 5562, Parent: 5538)

sh (PID: 5562, Parent: 5538, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 NiGGeR69xd || busybox pkill -9 NiGGeR69xd"

sh New Fork (PID: 5563, Parent: 5562)

pkill (PID: 5563, Parent: 5562, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 NiGGeR69xd

sh New Fork (PID: 5564, Parent: 5562)

busybox (PID: 5564, Parent: 5562, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 NiGGeR69xd

yakuza.x86.elf New Fork (PID: 5565, Parent: 5538)

sh (PID: 5565, Parent: 5538, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 SO190Ij1X || busybox pkill -9 SO190Ij1X"

sh New Fork (PID: 5566, Parent: 5565)

pkill (PID: 5566, Parent: 5565, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 SO190Ij1X

sh New Fork (PID: 5567, Parent: 5565)

busybox (PID: 5567, Parent: 5565, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 SO190Ij1X

yakuza.x86.elf New Fork (PID: 5570, Parent: 5538)

sh (PID: 5570, Parent: 5538, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 LOLKIKEEEDDE || busybox pkill -9 LOLKIKEEEDDE"

sh New Fork (PID: 5571, Parent: 5570)

pkill (PID: 5571, Parent: 5570, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 LOLKIKEEEDDE

sh New Fork (PID: 5572, Parent: 5570)

busybox (PID: 5572, Parent: 5570, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 LOLKIKEEEDDE

yakuza.x86.elf New Fork (PID: 5573, Parent: 5538)

sh (PID: 5573, Parent: 5538, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 ekjheory98e || busybox pkill -9 ekjheory98e"

sh New Fork (PID: 5574, Parent: 5573)

pkill (PID: 5574, Parent: 5573, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 ekjheory98e

sh New Fork (PID: 5575, Parent: 5573)

busybox (PID: 5575, Parent: 5573, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 ekjheory98e

yakuza.x86.elf New Fork (PID: 5597, Parent: 5538)

sh (PID: 5597, Parent: 5538, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 scansh4 || busybox pkill -9 scansh4"

sh New Fork (PID: 5598, Parent: 5597)

pkill (PID: 5598, Parent: 5597, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 scansh4

sh New Fork (PID: 5599, Parent: 5597)

busybox (PID: 5599, Parent: 5597, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 scansh4

yakuza.x86.elf New Fork (PID: 5600, Parent: 5538)

sh (PID: 5600, Parent: 5538, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 MDMA || busybox pkill -9 MDMA"

sh New Fork (PID: 5601, Parent: 5600)

pkill (PID: 5601, Parent: 5600, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 MDMA

sh New Fork (PID: 5602, Parent: 5600)

busybox (PID: 5602, Parent: 5600, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 MDMA

yakuza.x86.elf New Fork (PID: 5604, Parent: 5538)

sh (PID: 5604, Parent: 5538, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 fdevalvex || busybox pkill -9 fdevalvex"

sh New Fork (PID: 5605, Parent: 5604)

pkill (PID: 5605, Parent: 5604, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 fdevalvex

sh New Fork (PID: 5608, Parent: 5604)

busybox (PID: 5608, Parent: 5604, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 fdevalvex

yakuza.x86.elf New Fork (PID: 5609, Parent: 5538)

sh (PID: 5609, Parent: 5538, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 scanspc || busybox pkill -9 scanspc"

sh New Fork (PID: 5610, Parent: 5609)

pkill (PID: 5610, Parent: 5609, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 scanspc

sh New Fork (PID: 5611, Parent: 5609)

busybox (PID: 5611, Parent: 5609, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 scanspc

yakuza.x86.elf New Fork (PID: 5612, Parent: 5538)

sh (PID: 5612, Parent: 5538, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 MELTEDNINJAREALZ || busybox pkill -9 MELTEDNINJAREALZ"

sh New Fork (PID: 5613, Parent: 5612)

pkill (PID: 5613, Parent: 5612, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 MELTEDNINJAREALZ

sh New Fork (PID: 5616, Parent: 5612)

busybox (PID: 5616, Parent: 5612, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 MELTEDNINJAREALZ

yakuza.x86.elf New Fork (PID: 5617, Parent: 5538)

sh (PID: 5617, Parent: 5538, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 flexsonskids || busybox pkill -9 flexsonskids"

sh New Fork (PID: 5618, Parent: 5617)

pkill (PID: 5618, Parent: 5617, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 flexsonskids

sh New Fork (PID: 5619, Parent: 5617)

busybox (PID: 5619, Parent: 5617, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 flexsonskids

yakuza.x86.elf New Fork (PID: 5620, Parent: 5538)

sh (PID: 5620, Parent: 5538, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 scanx86 || busybox pkill -9 scanx86"

sh New Fork (PID: 5621, Parent: 5620)

pkill (PID: 5621, Parent: 5620, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 scanx86

sh New Fork (PID: 5624, Parent: 5620)

busybox (PID: 5624, Parent: 5620, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 scanx86

yakuza.x86.elf New Fork (PID: 5625, Parent: 5538)

sh (PID: 5625, Parent: 5538, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 MISAKI-U79OL || busybox pkill -9 MISAKI-U79OL"

sh New Fork (PID: 5626, Parent: 5625)

pkill (PID: 5626, Parent: 5625, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 MISAKI-U79OL

sh New Fork (PID: 5627, Parent: 5625)

busybox (PID: 5627, Parent: 5625, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 MISAKI-U79OL

yakuza.x86.elf New Fork (PID: 5628, Parent: 5538)

sh (PID: 5628, Parent: 5538, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 foAxi102kxe || busybox pkill -9 foAxi102kxe"

sh New Fork (PID: 5629, Parent: 5628)

pkill (PID: 5629, Parent: 5628, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 foAxi102kxe

sh New Fork (PID: 5632, Parent: 5628)

busybox (PID: 5632, Parent: 5628, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 foAxi102kxe

yakuza.x86.elf New Fork (PID: 5633, Parent: 5538)

sh (PID: 5633, Parent: 5538, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 swodjwodjwoj || busybox pkill -9 swodjwodjwoj"

sh New Fork (PID: 5634, Parent: 5633)

pkill (PID: 5634, Parent: 5633, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 swodjwodjwoj

sh New Fork (PID: 5635, Parent: 5633)

busybox (PID: 5635, Parent: 5633, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 swodjwodjwoj

yakuza.x86.elf New Fork (PID: 5636, Parent: 5538)

sh (PID: 5636, Parent: 5538, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 MmKiy7f87l || busybox pkill -9 MmKiy7f87l"

sh New Fork (PID: 5637, Parent: 5636)

pkill (PID: 5637, Parent: 5636, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 MmKiy7f87l

sh New Fork (PID: 5640, Parent: 5636)

busybox (PID: 5640, Parent: 5636, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 MmKiy7f87l

yakuza.x86.elf New Fork (PID: 5641, Parent: 5538)

sh (PID: 5641, Parent: 5538, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 freecookiex86 || busybox pkill -9 freecookiex86"

sh New Fork (PID: 5642, Parent: 5641)

pkill (PID: 5642, Parent: 5641, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 freecookiex86

sh New Fork (PID: 5643, Parent: 5641)

busybox (PID: 5643, Parent: 5641, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 freecookiex86

yakuza.x86.elf New Fork (PID: 5644, Parent: 5538)

sh (PID: 5644, Parent: 5538, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 sysgpu || busybox pkill -9 sysgpu"

sh New Fork (PID: 5645, Parent: 5644)

pkill (PID: 5645, Parent: 5644, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 sysgpu

sh New Fork (PID: 5648, Parent: 5644)

busybox (PID: 5648, Parent: 5644, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 sysgpu

yakuza.x86.elf New Fork (PID: 5651, Parent: 5538)

sh (PID: 5651, Parent: 5538, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 NiGGeR69xd || busybox pkill -9 NiGGeR69xd"

sh New Fork (PID: 5652, Parent: 5651)

pkill (PID: 5652, Parent: 5651, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 NiGGeR69xd

sh New Fork (PID: 5653, Parent: 5651)

busybox (PID: 5653, Parent: 5651, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 NiGGeR69xd

yakuza.x86.elf New Fork (PID: 5654, Parent: 5538)

sh (PID: 5654, Parent: 5538, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 frgege || busybox pkill -9 frgege"

sh New Fork (PID: 5655, Parent: 5654)

pkill (PID: 5655, Parent: 5654, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 frgege

sh New Fork (PID: 5657, Parent: 5654)

busybox (PID: 5657, Parent: 5654, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 frgege

yakuza.x86.elf New Fork (PID: 5660, Parent: 5538)

sh (PID: 5660, Parent: 5538, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 sysupdater || busybox pkill -9 sysupdater"

sh New Fork (PID: 5661, Parent: 5660)

pkill (PID: 5661, Parent: 5660, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 sysupdater

sh New Fork (PID: 5662, Parent: 5660)

busybox (PID: 5662, Parent: 5660, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 sysupdater

yakuza.x86.elf New Fork (PID: 5663, Parent: 5538)

sh (PID: 5663, Parent: 5538, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 0DnAzepd || busybox pkill -9 0DnAzepd"

sh New Fork (PID: 5664, Parent: 5663)

pkill (PID: 5664, Parent: 5663, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 0DnAzepd

sh New Fork (PID: 5665, Parent: 5663)

busybox (PID: 5665, Parent: 5663, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 0DnAzepd

yakuza.x86.elf New Fork (PID: 5668, Parent: 5538)

sh (PID: 5668, Parent: 5538, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 NiGGeRD0nks69 || busybox pkill -9 NiGGeRD0nks69"

sh New Fork (PID: 5669, Parent: 5668)

pkill (PID: 5669, Parent: 5668, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 NiGGeRD0nks69

sh New Fork (PID: 5670, Parent: 5668)

busybox (PID: 5670, Parent: 5668, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 NiGGeRD0nks69

yakuza.x86.elf New Fork (PID: 5671, Parent: 5538)

sh (PID: 5671, Parent: 5538, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 frgreu || busybox pkill -9 frgreu"

sh New Fork (PID: 5672, Parent: 5671)

pkill (PID: 5672, Parent: 5671, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 frgreu

sh New Fork (PID: 5673, Parent: 5671)

busybox (PID: 5673, Parent: 5671, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 frgreu

yakuza.x86.elf New Fork (PID: 5676, Parent: 5538)

sh (PID: 5676, Parent: 5538, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 telnetd || busybox pkill -9 telnetd"

sh New Fork (PID: 5677, Parent: 5676)

pkill (PID: 5677, Parent: 5676, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 telnetd

sh New Fork (PID: 5678, Parent: 5676)

busybox (PID: 5678, Parent: 5676, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 telnetd

yakuza.x86.elf New Fork (PID: 5679, Parent: 5538)

sh (PID: 5679, Parent: 5538, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 0x766f6964 || busybox pkill -9 0x766f6964"

sh New Fork (PID: 5680, Parent: 5679)

pkill (PID: 5680, Parent: 5679, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 0x766f6964

sh New Fork (PID: 5681, Parent: 5679)

busybox (PID: 5681, Parent: 5679, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 0x766f6964

yakuza.x86.elf New Fork (PID: 5682, Parent: 5538)

sh (PID: 5682, Parent: 5538, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 NiGGeRd0nks1337 || busybox pkill -9 NiGGeRd0nks1337"

sh New Fork (PID: 5683, Parent: 5682)

pkill (PID: 5683, Parent: 5682, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 NiGGeRd0nks1337

sh New Fork (PID: 5686, Parent: 5682)

busybox (PID: 5686, Parent: 5682, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 NiGGeRd0nks1337

yakuza.x86.elf New Fork (PID: 5687, Parent: 5538)

sh (PID: 5687, Parent: 5538, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 gaft || busybox pkill -9 gaft"

sh New Fork (PID: 5688, Parent: 5687)

pkill (PID: 5688, Parent: 5687, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 gaft

sh New Fork (PID: 5689, Parent: 5687)

busybox (PID: 5689, Parent: 5687, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 gaft

yakuza.x86.elf New Fork (PID: 5690, Parent: 5538)

sh (PID: 5690, Parent: 5538, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 urasgbsigboa || busybox pkill -9 urasgbsigboa"

sh New Fork (PID: 5691, Parent: 5690)

pkill (PID: 5691, Parent: 5690, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 urasgbsigboa

sh New Fork (PID: 5694, Parent: 5690)

busybox (PID: 5694, Parent: 5690, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 urasgbsigboa

yakuza.x86.elf New Fork (PID: 5695, Parent: 5538)

sh (PID: 5695, Parent: 5538, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 120i3UI49 || busybox pkill -9 120i3UI49"

sh New Fork (PID: 5696, Parent: 5695)

pkill (PID: 5696, Parent: 5695, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 120i3UI49

sh New Fork (PID: 5697, Parent: 5695)

busybox (PID: 5697, Parent: 5695, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 120i3UI49

yakuza.x86.elf New Fork (PID: 5698, Parent: 5538)

sh (PID: 5698, Parent: 5538, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 OaF3 || busybox pkill -9 OaF3"

sh New Fork (PID: 5699, Parent: 5698)

pkill (PID: 5699, Parent: 5698, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 OaF3

sh New Fork (PID: 5702, Parent: 5698)

busybox (PID: 5702, Parent: 5698, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 OaF3

yakuza.x86.elf New Fork (PID: 5703, Parent: 5538)

sh (PID: 5703, Parent: 5538, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 geae || busybox pkill -9 geae"

sh New Fork (PID: 5704, Parent: 5703)

pkill (PID: 5704, Parent: 5703, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 geae

sh New Fork (PID: 5705, Parent: 5703)

busybox (PID: 5705, Parent: 5703, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 geae

yakuza.x86.elf New Fork (PID: 5706, Parent: 5538)

sh (PID: 5706, Parent: 5538, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 vaiolmao || busybox pkill -9 vaiolmao"

sh New Fork (PID: 5707, Parent: 5706)

pkill (PID: 5707, Parent: 5706, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 vaiolmao

sh New Fork (PID: 5709, Parent: 5706)

busybox (PID: 5709, Parent: 5706, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 vaiolmao

yakuza.x86.elf New Fork (PID: 5712, Parent: 5538)

sh (PID: 5712, Parent: 5538, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 123123a || busybox pkill -9 123123a"

sh New Fork (PID: 5713, Parent: 5712)

pkill (PID: 5713, Parent: 5712, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 123123a

sh New Fork (PID: 5714, Parent: 5712)

busybox (PID: 5714, Parent: 5712, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 123123a

yakuza.x86.elf New Fork (PID: 5715, Parent: 5538)

sh (PID: 5715, Parent: 5538, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 Ofurain0n4H34D || busybox pkill -9 Ofurain0n4H34D"

sh New Fork (PID: 5716, Parent: 5715)

pkill (PID: 5716, Parent: 5715, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 Ofurain0n4H34D

sh New Fork (PID: 5717, Parent: 5715)

busybox (PID: 5717, Parent: 5715, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 Ofurain0n4H34D

yakuza.x86.elf New Fork (PID: 5720, Parent: 5538)

sh (PID: 5720, Parent: 5538, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 ggTrex || busybox pkill -9 ggTrex"

sh New Fork (PID: 5721, Parent: 5720)

pkill (PID: 5721, Parent: 5720, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 ggTrex

sh New Fork (PID: 5722, Parent: 5720)

busybox (PID: 5722, Parent: 5720, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 ggTrex

yakuza.x86.elf New Fork (PID: 5723, Parent: 5538)

sh (PID: 5723, Parent: 5538, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 wasads || busybox pkill -9 wasads"

sh New Fork (PID: 5724, Parent: 5723)

pkill (PID: 5724, Parent: 5723, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 wasads

sh New Fork (PID: 5725, Parent: 5723)

busybox (PID: 5725, Parent: 5723, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 wasads

yakuza.x86.elf New Fork (PID: 5728, Parent: 5538)

sh (PID: 5728, Parent: 5538, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 1293194hjXD || busybox pkill -9 1293194hjXD"

sh New Fork (PID: 5729, Parent: 5728)

pkill (PID: 5729, Parent: 5728, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 1293194hjXD

sh New Fork (PID: 5730, Parent: 5728)

busybox (PID: 5730, Parent: 5728, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 1293194hjXD

yakuza.x86.elf New Fork (PID: 5731, Parent: 5538)

sh (PID: 5731, Parent: 5538, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 OthLaLosn || busybox pkill -9 OthLaLosn"

sh New Fork (PID: 5732, Parent: 5731)

pkill (PID: 5732, Parent: 5731, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 OthLaLosn

sh New Fork (PID: 5733, Parent: 5731)

busybox (PID: 5733, Parent: 5731, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 OthLaLosn

yakuza.x86.elf New Fork (PID: 5736, Parent: 5538)

sh (PID: 5736, Parent: 5538, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 ggt || busybox pkill -9 ggt"

sh New Fork (PID: 5737, Parent: 5736)

pkill (PID: 5737, Parent: 5736, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 ggt

sh New Fork (PID: 5738, Parent: 5736)

busybox (PID: 5738, Parent: 5736, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 ggt

yakuza.x86.elf New Fork (PID: 5739, Parent: 5538)

sh (PID: 5739, Parent: 5538, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 wget-log || busybox pkill -9 wget-log"

sh New Fork (PID: 5740, Parent: 5739)

pkill (PID: 5740, Parent: 5739, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 wget-log

sh New Fork (PID: 5741, Parent: 5739)

busybox (PID: 5741, Parent: 5739, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 wget-log

yakuza.x86.elf New Fork (PID: 5744, Parent: 5538)

sh (PID: 5744, Parent: 5538, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 1337SoraLOADER || busybox pkill -9 1337SoraLOADER"

sh New Fork (PID: 5745, Parent: 5744)

pkill (PID: 5745, Parent: 5744, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 1337SoraLOADER

sh New Fork (PID: 5746, Parent: 5744)

busybox (PID: 5746, Parent: 5744, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 1337SoraLOADER

yakuza.x86.elf New Fork (PID: 5747, Parent: 5538)

sh (PID: 5747, Parent: 5538, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 SAIAKINA || busybox pkill -9 SAIAKINA"

sh New Fork (PID: 5748, Parent: 5747)

pkill (PID: 5748, Parent: 5747, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 SAIAKINA

sh New Fork (PID: 5751, Parent: 5747)

busybox (PID: 5751, Parent: 5747, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 SAIAKINA

yakuza.x86.elf New Fork (PID: 5754, Parent: 5538)

sh (PID: 5754, Parent: 5538, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 ggtq || busybox pkill -9 ggtq"

sh New Fork (PID: 5755, Parent: 5754)

pkill (PID: 5755, Parent: 5754, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 ggtq

sh New Fork (PID: 5756, Parent: 5754)

busybox (PID: 5756, Parent: 5754, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 ggtq

yakuza.x86.elf New Fork (PID: 5757, Parent: 5538)

sh (PID: 5757, Parent: 5538, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 1378bfp919GRB1Q2 || busybox pkill -9 1378bfp919GRB1Q2"

sh New Fork (PID: 5758, Parent: 5757)

pkill (PID: 5758, Parent: 5757, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 1378bfp919GRB1Q2

sh New Fork (PID: 5760, Parent: 5757)

busybox (PID: 5760, Parent: 5757, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 1378bfp919GRB1Q2

yakuza.x86.elf New Fork (PID: 5763, Parent: 5538)

sh (PID: 5763, Parent: 5538, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 SAIAKUSO || busybox pkill -9 SAIAKUSO"

sh New Fork (PID: 5764, Parent: 5763)

pkill (PID: 5764, Parent: 5763, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 SAIAKUSO

sh New Fork (PID: 5765, Parent: 5763)

busybox (PID: 5765, Parent: 5763, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 SAIAKUSO

yakuza.x86.elf New Fork (PID: 5766, Parent: 5538)

sh (PID: 5766, Parent: 5538, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 ggtr || busybox pkill -9 ggtr"

sh New Fork (PID: 5767, Parent: 5766)

pkill (PID: 5767, Parent: 5766, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 ggtr

sh New Fork (PID: 5768, Parent: 5766)

busybox (PID: 5768, Parent: 5766, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 ggtr

yakuza.x86.elf New Fork (PID: 5771, Parent: 5538)

sh (PID: 5771, Parent: 5538, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 14Fa || busybox pkill -9 14Fa"

sh New Fork (PID: 5772, Parent: 5771)

pkill (PID: 5772, Parent: 5771, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 14Fa

sh New Fork (PID: 5773, Parent: 5771)

busybox (PID: 5773, Parent: 5771, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 14Fa

yakuza.x86.elf New Fork (PID: 5774, Parent: 5538)

sh (PID: 5774, Parent: 5538, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 SEXSLAVE1337 || busybox pkill -9 SEXSLAVE1337"

sh New Fork (PID: 5775, Parent: 5774)

pkill (PID: 5775, Parent: 5774, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 SEXSLAVE1337

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
yakuza.x86.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
yakuza.x86.elf	Linux_Trojan_Gafgyt_a6a2adb9	unknown	unknown	0x3b05:$a: CC 01 C2 89 55 B4 8B 45 B4 C9 C3 55 48 89 E5 48 81 EC 90 00
yakuza.x86.elf	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0xcd90:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
yakuza.x86.elf	Linux_Trojan_Gafgyt_f3d83a74	unknown	unknown	0x3a2c:$a: DC 00 74 1B 83 7D E0 0A 75 15 83 7D E4 00 79 0F C7 45 C8 01 00
yakuza.x86.elf	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0xd443:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
yakuza.x86.elf	Linux_Trojan_Gafgyt_e0673a90	unknown	unknown	0x2e2:$a: 45 E8 0F B6 00 84 C0 74 17 48 8B 75 E8 48 FF C6 48 8B 7D F0 48
yakuza.x86.elf	Linux_Trojan_Gafgyt_821173df	unknown	unknown	0x5c4:$a: D0 48 FF C8 48 03 45 F8 48 FF C8 C6 00 00 48 8B 45 F8 48 C7 C1 FF FF
yakuza.x86.elf	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0x86aa:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x890c:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
yakuza.x86.elf	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0xffb6:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
yakuza.x86.elf	Linux_Trojan_Gafgyt_d0c57a2e	unknown	unknown	0x12396:$a: 07 0F B6 57 01 C1 E0 08 09 D0 89 06 0F BE 47 02 C1 E8 1F 89
yakuza.x86.elf	Linux_Trojan_Gafgyt_656bf077	unknown	unknown	0x2a4:$a: 74 28 48 8B 45 E8 0F B6 00 84 C0 74 14 48 8B 75 E8 48 FF C6 48 8B
yakuza.x86.elf	Linux_Trojan_Gafgyt_148b91a2	unknown	unknown	0x4527:$a: C6 45 DB FC EB 04 C6 45 DB FE 0F B6 45 DB 88 45 FF 48 8D 75 FF 8B
yakuza.x86.elf	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0xd003:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
yakuza.x86.elf	Linux_Trojan_Gafgyt_779e142f	unknown	unknown	0x3954:$a: EC 8B 45 E8 83 E0 02 85 C0 74 07 C7 45 D8 30 00 00 00 8B 45 E8 83
yakuza.x86.elf	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0x10172:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
yakuza.x86.elf	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0xd2ce:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
yakuza.x86.elf	Linux_Trojan_Gafgyt_32eb0c81	unknown	unknown	0x39a1:$a: D4 48 FF 45 F0 48 8B 45 F0 0F B6 00 84 C0 75 DB EB 12 48 8B
yakuza.x86.elf	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0x1036b:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
yakuza.x86.elf	Linux_Trojan_Tsunami_e98b83ee	unknown	unknown	0x9d5:$a: 45 FE 00 00 EB 16 48 8B 55 D8 0F B7 02 0F B7 C0 01 45 E0 48 83 45
yakuza.x86.elf	Linux_Trojan_Tsunami_8a11f9be	unknown	unknown	0x151d9:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20 0x158bd:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20
yakuza.x86.elf	Linux_Trojan_Tsunami_0e52c842	unknown	unknown	0x68ca:$a: 55 48 89 E5 53 48 83 EC 38 89 7D E4 48 89 75 D8 89 55 D4 48 89
Click to see the 16 entries

Memory Dumps

Source	Rule	Description	Author	Strings
5537.1.0000000000400000.0000000000419000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
5537.1.0000000000400000.0000000000419000.r-x.sdmp	Linux_Trojan_Gafgyt_a6a2adb9	unknown	unknown	0x3b05:$a: CC 01 C2 89 55 B4 8B 45 B4 C9 C3 55 48 89 E5 48 81 EC 90 00
5537.1.0000000000400000.0000000000419000.r-x.sdmp	Linux_Trojan_Gafgyt_9e9530a7	unknown	unknown	0xcd90:$a: F6 48 63 FF B8 36 00 00 00 0F 05 48 3D 00 F0 FF FF 48 89 C3
5537.1.0000000000400000.0000000000419000.r-x.sdmp	Linux_Trojan_Gafgyt_f3d83a74	unknown	unknown	0x3a2c:$a: DC 00 74 1B 83 7D E0 0A 75 15 83 7D E4 00 79 0F C7 45 C8 01 00
5537.1.0000000000400000.0000000000419000.r-x.sdmp	Linux_Trojan_Gafgyt_807911a2	unknown	unknown	0xd443:$a: FE 48 39 F3 0F 94 C2 48 83 F9 FF 0F 94 C0 84 D0 74 16 4B 8D
5537.1.0000000000400000.0000000000419000.r-x.sdmp	Linux_Trojan_Gafgyt_e0673a90	unknown	unknown	0x2e2:$a: 45 E8 0F B6 00 84 C0 74 17 48 8B 75 E8 48 FF C6 48 8B 7D F0 48
5537.1.0000000000400000.0000000000419000.r-x.sdmp	Linux_Trojan_Gafgyt_821173df	unknown	unknown	0x5c4:$a: D0 48 FF C8 48 03 45 F8 48 FF C8 C6 00 00 48 8B 45 F8 48 C7 C1 FF FF
5537.1.0000000000400000.0000000000419000.r-x.sdmp	Linux_Trojan_Gafgyt_d4227dbf	unknown	unknown	0x86aa:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00 0x890c:$a: FF 48 81 EC D0 00 00 00 48 8D 84 24 E0 00 00 00 48 89 54 24 30 C7 04 24 18 00
5537.1.0000000000400000.0000000000419000.r-x.sdmp	Linux_Trojan_Gafgyt_d996d335	unknown	unknown	0xffb6:$a: D0 EB 0F 40 38 37 75 04 48 89 F8 C3 49 FF C8 48 FF C7 4D 85 C0
5537.1.0000000000400000.0000000000419000.r-x.sdmp	Linux_Trojan_Gafgyt_d0c57a2e	unknown	unknown	0x12396:$a: 07 0F B6 57 01 C1 E0 08 09 D0 89 06 0F BE 47 02 C1 E8 1F 89
5537.1.0000000000400000.0000000000419000.r-x.sdmp	Linux_Trojan_Gafgyt_656bf077	unknown	unknown	0x2a4:$a: 74 28 48 8B 45 E8 0F B6 00 84 C0 74 14 48 8B 75 E8 48 FF C6 48 8B
5537.1.0000000000400000.0000000000419000.r-x.sdmp	Linux_Trojan_Gafgyt_148b91a2	unknown	unknown	0x4527:$a: C6 45 DB FC EB 04 C6 45 DB FE 0F B6 45 DB 88 45 FF 48 8D 75 FF 8B
5537.1.0000000000400000.0000000000419000.r-x.sdmp	Linux_Trojan_Gafgyt_620087b9	unknown	unknown	0xd003:$a: 48 89 D8 48 83 C8 01 EB 04 48 8B 76 10 48 3B 46 08 72 F6 48 8B
5537.1.0000000000400000.0000000000419000.r-x.sdmp	Linux_Trojan_Gafgyt_779e142f	unknown	unknown	0x3954:$a: EC 8B 45 E8 83 E0 02 85 C0 74 07 C7 45 D8 30 00 00 00 8B 45 E8 83
5537.1.0000000000400000.0000000000419000.r-x.sdmp	Linux_Trojan_Gafgyt_0cd591cd	unknown	unknown	0x10172:$a: 4E F8 48 8D 4E D8 49 8D 42 E0 48 83 C7 03 EB 6B 4C 8B 46 F8 48 8D
5537.1.0000000000400000.0000000000419000.r-x.sdmp	Linux_Trojan_Gafgyt_33b4111a	unknown	unknown	0xd2ce:$a: C1 83 E1 0F 74 1A B8 10 00 00 00 48 29 C8 48 8D 0C 02 48 89 DA 48
5537.1.0000000000400000.0000000000419000.r-x.sdmp	Linux_Trojan_Gafgyt_32eb0c81	unknown	unknown	0x39a1:$a: D4 48 FF 45 F0 48 8B 45 F0 0F B6 00 84 C0 75 DB EB 12 48 8B
5537.1.0000000000400000.0000000000419000.r-x.sdmp	Linux_Trojan_Gafgyt_a33a8363	unknown	unknown	0x1036b:$a: 41 88 02 48 85 D2 75 ED 5A 5B 5D 41 5C 41 5D 4C 89 F0 41 5E
5537.1.0000000000400000.0000000000419000.r-x.sdmp	Linux_Trojan_Tsunami_e98b83ee	unknown	unknown	0x9d5:$a: 45 FE 00 00 EB 16 48 8B 55 D8 0F B7 02 0F B7 C0 01 45 E0 48 83 45
5537.1.0000000000400000.0000000000419000.r-x.sdmp	Linux_Trojan_Tsunami_8a11f9be	unknown	unknown	0x151d9:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20 0x158bd:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20
5537.1.0000000000400000.0000000000419000.r-x.sdmp	Linux_Trojan_Tsunami_0e52c842	unknown	unknown	0x68ca:$a: 55 48 89 E5 53 48 83 EC 38 89 7D E4 48 89 75 D8 89 55 D4 48 89
Process Memory Space: yakuza.x86.elf PID: 5537	Linux_Trojan_Tsunami_8a11f9be	unknown	unknown	0x41c0:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20 0x4334:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20 0x49a1:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20
Click to see the 17 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: yakuza.x86.elf

ReversingLabs: Detection: 63%

Machine Learning detection for sample

Source: yakuza.x86.elf

Joe Sandbox ML: detected

Source: /usr/bin/pkill (PID: 5542)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5547)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5550)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5555)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5558)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5563)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5566)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5571)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5574)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5598)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5601)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5605)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5610)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5613)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5618)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5621)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5626)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5629)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5634)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5637)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5642)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5645)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5652)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5655)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5661)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5664)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5669)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5672)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5677)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5680)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5683)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5688)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5691)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5696)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5699)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5704)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5707)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5713)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5716)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5721)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5724)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5729)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5732)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5737)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5740)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5745)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5748)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5755)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5758)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5764)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5767)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5772)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5775)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Networking

Uses IRC for communication with a C&C

Source: unknown

IRC traffic detected: 192.168.2.14:56980 -> 95.234.158.87:6780 NICK [OSX|x86_64]iKAieWz USER iKAieWz localhost localhost :iKAieWz

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: IRC traffic on port 56980 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 56982 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 56984 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 56986 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 56988 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 56990 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 56992 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 56994 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 56996 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 56998 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 57000 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 57002 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 57004 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 57006 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 57008 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 57010 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 57012 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 57014 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 57016 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 57018 -> 6780

Source: global traffic

TCP traffic: 192.168.2.14:56980 -> 95.234.158.87:6780

Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87
Source: unknown	TCP traffic detected without corresponding DNS query: 95.234.158.87

Source: yakuza.x86.elf	String found in binary or memory: http://linux-it.abuser.eu/yak.sh;
Source: yakuza.x86.elf	String found in binary or memory: https://youtu.be/dQw4w9WgXcQ
Source: yakuza.x86.elf	String found in binary or memory: https://youtu.be/dQw4w9WgXcQNever

System Summary

Malicious sample detected (through community Yara rule)

Source: yakuza.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 Author: unknown
Source: yakuza.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: yakuza.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 Author: unknown
Source: yakuza.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: yakuza.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_e0673a90 Author: unknown
Source: yakuza.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_821173df Author: unknown
Source: yakuza.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: yakuza.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: yakuza.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d0c57a2e Author: unknown
Source: yakuza.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_656bf077 Author: unknown
Source: yakuza.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_148b91a2 Author: unknown
Source: yakuza.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: yakuza.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_779e142f Author: unknown
Source: yakuza.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: yakuza.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: yakuza.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_32eb0c81 Author: unknown
Source: yakuza.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: yakuza.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Tsunami_e98b83ee Author: unknown
Source: yakuza.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Tsunami_8a11f9be Author: unknown
Source: yakuza.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Tsunami_0e52c842 Author: unknown
Source: 5537.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 Author: unknown
Source: 5537.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 Author: unknown
Source: 5537.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 Author: unknown
Source: 5537.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 Author: unknown
Source: 5537.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_e0673a90 Author: unknown
Source: 5537.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_821173df Author: unknown
Source: 5537.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf Author: unknown
Source: 5537.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 Author: unknown
Source: 5537.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d0c57a2e Author: unknown
Source: 5537.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_656bf077 Author: unknown
Source: 5537.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_148b91a2 Author: unknown
Source: 5537.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 Author: unknown
Source: 5537.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_779e142f Author: unknown
Source: 5537.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd Author: unknown
Source: 5537.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a Author: unknown
Source: 5537.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_32eb0c81 Author: unknown
Source: 5537.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 Author: unknown
Source: 5537.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_e98b83ee Author: unknown
Source: 5537.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_8a11f9be Author: unknown
Source: 5537.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_0e52c842 Author: unknown
Source: Process Memory Space: yakuza.x86.elf PID: 5537, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_8a11f9be Author: unknown

Source: yakuza.x86.elf	ELF static info symbol of initial sample: passwords
Source: yakuza.x86.elf	ELF static info symbol of initial sample: usernames

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: pkill -9 %s \|\| busybox pkill -9 %s
Source: Initial sample	String containing 'busybox' found: pkill -9 %s \|\| busybox pkill -9 %shistory -c;history -wcd /root;rm -f .bash_historycd /var/tmp; rm -f *NOTICE %s :MOVE <server>

Source: Initial sample	String containing potential weak password found: guest
Source: Initial sample	String containing potential weak password found: default
Source: Initial sample	String containing potential weak password found: admin
Source: Initial sample	String containing potential weak password found: supervisor
Source: Initial sample	String containing potential weak password found: service
Source: Initial sample	String containing potential weak password found: administrator
Source: Initial sample	String containing potential weak password found: support
Source: Initial sample	String containing potential weak password found: 123456
Source: Initial sample	String containing potential weak password found: password
Source: Initial sample	String containing potential weak password found: 12345

Source: yakuza.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = cdd0bb9ce40a000bb86b0c76616fe71fb7dbb87a044ddd778b7a07fdf804b877, id = a6a2adb9-9d54-42d4-abed-5b30d8062e97, last_modified = 2021-09-16
Source: yakuza.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: yakuza.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 1c5df68501b688905484ed47dc588306828aa7c114644428e22e5021bb39bd4a, id = f3d83a74-2888-435a-9a3c-b7de25084e9a, last_modified = 2021-09-16
Source: yakuza.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: yakuza.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_e0673a90 reference_sample = c5a317d0d8470814ff343ce78ad2428ebb3f036763fcf703a589b6c4d33a3ec6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 6834f65d54bbfb926f986fe2dd72cd30bf9804ed65fcc71c2c848e72350f386a, id = e0673a90-165e-4347-a965-e8d14fdf684b, last_modified = 2021-09-16
Source: yakuza.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_821173df reference_sample = de7d1aff222c7d474e1a42b2368885ef16317e8da1ca3a63009bf06376026163, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = c311789e1370227f7be1d87da0c370a905b7f5b4c55cdee0f0474060cc0fc5e4, id = 821173df-6835-41e1-a662-a432abf23431, last_modified = 2021-09-16
Source: yakuza.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: yakuza.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: yakuza.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_d0c57a2e os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ee7d3a33575ed3aa7431489a8fb18bf30cfd5d6c776066ab2a27f93303124b6, id = d0c57a2e-c10c-436c-be13-50a269326cf2, last_modified = 2021-09-16
Source: yakuza.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_656bf077 reference_sample = c5a317d0d8470814ff343ce78ad2428ebb3f036763fcf703a589b6c4d33a3ec6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ea8ed60190198d5887bb7093975d648a9fd78234827d648a8258008c965b1c1, id = 656bf077-ca0c-4d28-9daa-eb6baafaf467, last_modified = 2021-09-16
Source: yakuza.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_148b91a2 reference_sample = d5b2bde0749ff482dc2389971e2ac76c4b1e7b887208a538d5555f0fe6984825, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 0f75090ed840f4601df4e43a2f49f2b32585213f3d86d19fb255d79c21086ba3, id = 148b91a2-ed51-4c2d-9d15-6a48d9ea3e0a, last_modified = 2021-09-16
Source: yakuza.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: yakuza.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_779e142f reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 83377b6fa77fda4544c409487d2d2c1ddcef8f7d4120f49a18888c7536f3969f, id = 779e142f-b867-46e6-b1fb-9105976f42fd, last_modified = 2021-09-16
Source: yakuza.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: yakuza.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: yakuza.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_32eb0c81 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 7c50ed29e2dd75a6a85afc43f8452794cb787ecd2061f4bf415d7038c14c523f, id = 32eb0c81-25af-4670-ab77-07ea7ce1874a, last_modified = 2021-09-16
Source: yakuza.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: yakuza.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Tsunami_e98b83ee reference_sample = cf1ca1d824c8687e87a5b0275a0e39fa101442b4bbf470859ddda9982f9b3417, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = b5440c783bc18e23f27a3131ccce4629f8d0ceea031971cbcdb69370ab52e935, id = e98b83ee-0533-481a-9947-538bd2f99b6b, last_modified = 2021-09-16
Source: yakuza.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Tsunami_8a11f9be reference_sample = 1f773d0e00d40eecde9e3ab80438698923a2620036c2fc33315ef95229e98571, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = 91e2572a3bb8583e20042578e95e1746501c6a71ef7635af2c982a05b18d7c6d, id = 8a11f9be-dc85-4695-9f38-80ca0304780e, last_modified = 2021-09-16
Source: yakuza.x86.elf, type: SAMPLE	Matched rule: Linux_Trojan_Tsunami_0e52c842 reference_sample = cf1ca1d824c8687e87a5b0275a0e39fa101442b4bbf470859ddda9982f9b3417, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = 70fdfb7aa5d1eff98e4e216e7a60ed1ba4d75ed1f47a57bf40eeaf35a92c88e4, id = 0e52c842-f65e-4c77-8081-ae2f160e35f4, last_modified = 2021-09-16
Source: 5537.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a6a2adb9 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = cdd0bb9ce40a000bb86b0c76616fe71fb7dbb87a044ddd778b7a07fdf804b877, id = a6a2adb9-9d54-42d4-abed-5b30d8062e97, last_modified = 2021-09-16
Source: 5537.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_9e9530a7 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = d6ad6512051e87c8c35dc168d82edd071b122d026dce21d39b9782b3d6a01e50, id = 9e9530a7-ad4d-4a44-b764-437b7621052f, last_modified = 2021-09-16
Source: 5537.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_f3d83a74 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 1c5df68501b688905484ed47dc588306828aa7c114644428e22e5021bb39bd4a, id = f3d83a74-2888-435a-9a3c-b7de25084e9a, last_modified = 2021-09-16
Source: 5537.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_807911a2 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = f409037091b7372f5a42bbe437316bd11c655e7a5fe1fcf83d1981cb5c4a389f, id = 807911a2-f6ec-4e65-924f-61cb065dafc6, last_modified = 2021-09-16
Source: 5537.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_e0673a90 reference_sample = c5a317d0d8470814ff343ce78ad2428ebb3f036763fcf703a589b6c4d33a3ec6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 6834f65d54bbfb926f986fe2dd72cd30bf9804ed65fcc71c2c848e72350f386a, id = e0673a90-165e-4347-a965-e8d14fdf684b, last_modified = 2021-09-16
Source: 5537.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_821173df reference_sample = de7d1aff222c7d474e1a42b2368885ef16317e8da1ca3a63009bf06376026163, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = c311789e1370227f7be1d87da0c370a905b7f5b4c55cdee0f0474060cc0fc5e4, id = 821173df-6835-41e1-a662-a432abf23431, last_modified = 2021-09-16
Source: 5537.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d4227dbf reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 58c4b1d4d167876b64cfa10f609911a80284180e4db093917fea16fae8ccd4e3, id = d4227dbf-6ab4-4637-a6ba-0e604acaafb4, last_modified = 2021-09-16
Source: 5537.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d996d335 reference_sample = b511eacd4b44744c8cf82d1b4a9bc6f1022fe6be7c5d17356b171f727ddc6eda, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = e9ccb8412f32187c309b0e9afcc3a6da21ad2f1ffa251c27f9f720ccb284e3ac, id = d996d335-e049-4052-bf36-6cd07c911a8b, last_modified = 2021-09-16
Source: 5537.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_d0c57a2e os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ee7d3a33575ed3aa7431489a8fb18bf30cfd5d6c776066ab2a27f93303124b6, id = d0c57a2e-c10c-436c-be13-50a269326cf2, last_modified = 2021-09-16
Source: 5537.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_656bf077 reference_sample = c5a317d0d8470814ff343ce78ad2428ebb3f036763fcf703a589b6c4d33a3ec6, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 3ea8ed60190198d5887bb7093975d648a9fd78234827d648a8258008c965b1c1, id = 656bf077-ca0c-4d28-9daa-eb6baafaf467, last_modified = 2021-09-16
Source: 5537.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_148b91a2 reference_sample = d5b2bde0749ff482dc2389971e2ac76c4b1e7b887208a538d5555f0fe6984825, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 0f75090ed840f4601df4e43a2f49f2b32585213f3d86d19fb255d79c21086ba3, id = 148b91a2-ed51-4c2d-9d15-6a48d9ea3e0a, last_modified = 2021-09-16
Source: 5537.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_620087b9 reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 06cd7e6eb62352ec2ccb9ed48e58c0583c02fefd137cd048d053ab30b5330307, id = 620087b9-c87d-4752-89e8-ca1c16486b28, last_modified = 2021-09-16
Source: 5537.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_779e142f reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 83377b6fa77fda4544c409487d2d2c1ddcef8f7d4120f49a18888c7536f3969f, id = 779e142f-b867-46e6-b1fb-9105976f42fd, last_modified = 2021-09-16
Source: 5537.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_0cd591cd os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 96c4ff70729ddb981adafd8c8277649a88a87e380d2f321dff53f0741675fb1b, id = 0cd591cd-c348-4c3a-a895-2063cf892cda, last_modified = 2021-09-16
Source: 5537.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_33b4111a reference_sample = 01da73e0d425b4d97c5ad75c49657f95618b394d09bd6be644eb968a3b894961, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 9c3b63b9a0f54006bae12abcefdb518904a85f78be573f0780f0a265b12d2d6e, id = 33b4111a-e59e-48db-9d74-34ca44fcd9f5, last_modified = 2021-09-16
Source: 5537.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_32eb0c81 reference_sample = 275cbd5d3b3d8c521649b95122d90d1ca9b7ae1958b721bdc158aaa2d31d49df, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 7c50ed29e2dd75a6a85afc43f8452794cb787ecd2061f4bf415d7038c14c523f, id = 32eb0c81-25af-4670-ab77-07ea7ce1874a, last_modified = 2021-09-16
Source: 5537.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Gafgyt_a33a8363 os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Gafgyt, fingerprint = 74f964eaadbf8f30d40cdec40b603c5141135d2e658e7ce217d0d6c62e18dd08, id = a33a8363-5511-4fe1-a0d8-75156b9ccfc7, last_modified = 2021-09-16
Source: 5537.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_e98b83ee reference_sample = cf1ca1d824c8687e87a5b0275a0e39fa101442b4bbf470859ddda9982f9b3417, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = b5440c783bc18e23f27a3131ccce4629f8d0ceea031971cbcdb69370ab52e935, id = e98b83ee-0533-481a-9947-538bd2f99b6b, last_modified = 2021-09-16
Source: 5537.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_8a11f9be reference_sample = 1f773d0e00d40eecde9e3ab80438698923a2620036c2fc33315ef95229e98571, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = 91e2572a3bb8583e20042578e95e1746501c6a71ef7635af2c982a05b18d7c6d, id = 8a11f9be-dc85-4695-9f38-80ca0304780e, last_modified = 2021-09-16
Source: 5537.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_0e52c842 reference_sample = cf1ca1d824c8687e87a5b0275a0e39fa101442b4bbf470859ddda9982f9b3417, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = 70fdfb7aa5d1eff98e4e216e7a60ed1ba4d75ed1f47a57bf40eeaf35a92c88e4, id = 0e52c842-f65e-4c77-8081-ae2f160e35f4, last_modified = 2021-09-16
Source: Process Memory Space: yakuza.x86.elf PID: 5537, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_8a11f9be reference_sample = 1f773d0e00d40eecde9e3ab80438698923a2620036c2fc33315ef95229e98571, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = 91e2572a3bb8583e20042578e95e1746501c6a71ef7635af2c982a05b18d7c6d, id = 8a11f9be-dc85-4695-9f38-80ca0304780e, last_modified = 2021-09-16

Source: classification engine

Classification label: mal76.troj.linELF@0/0@0/0

Source: yakuza.x86.elf	ELF static info symbol of initial sample: libc/string/x86_64/memcpy.S
Source: yakuza.x86.elf	ELF static info symbol of initial sample: libc/string/x86_64/mempcpy.S
Source: yakuza.x86.elf	ELF static info symbol of initial sample: libc/string/x86_64/memset.S
Source: yakuza.x86.elf	ELF static info symbol of initial sample: libc/string/x86_64/strchr.S
Source: yakuza.x86.elf	ELF static info symbol of initial sample: libc/string/x86_64/strcmp.S
Source: yakuza.x86.elf	ELF static info symbol of initial sample: libc/string/x86_64/strcpy.S
Source: yakuza.x86.elf	ELF static info symbol of initial sample: libc/string/x86_64/strlen.S
Source: yakuza.x86.elf	ELF static info symbol of initial sample: libc/string/x86_64/strpbrk.S
Source: yakuza.x86.elf	ELF static info symbol of initial sample: libc/string/x86_64/strspn.S
Source: yakuza.x86.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/x86_64/crt1.S
Source: yakuza.x86.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/x86_64/crti.S
Source: yakuza.x86.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/x86_64/crtn.S
Source: yakuza.x86.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/x86_64/vfork.S

Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/1583/status
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/1583/cmdline
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/2672/status
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/2672/cmdline
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/110/status
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/110/cmdline
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/111/status
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/111/cmdline
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/112/status
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/112/cmdline
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/113/status
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/113/cmdline
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/234/status
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/234/cmdline
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/1577/status
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/1577/cmdline
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/114/status
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/114/cmdline
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/235/status
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/235/cmdline
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/115/status
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/115/cmdline
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/116/status
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/116/cmdline
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/117/status
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/117/cmdline
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/118/status
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/118/cmdline
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/119/status
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/119/cmdline
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/10/status
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/10/cmdline
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/917/status
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/917/cmdline
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/11/status
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/11/cmdline
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/12/status
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/12/cmdline
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/13/status
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/13/cmdline
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/14/status
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/14/cmdline
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/15/status
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/15/cmdline
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/16/status
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/16/cmdline
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/17/status
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/17/cmdline
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/18/status
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/18/cmdline
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/19/status
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/19/cmdline
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/1593/status
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/1593/cmdline
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/240/status
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/240/cmdline
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/120/status
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/120/cmdline
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/3094/status
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/3094/cmdline
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/121/status
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/121/cmdline
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/242/status
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/242/cmdline
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/3406/status
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/3406/cmdline
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/1/status
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/1/cmdline
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/122/status
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/122/cmdline
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/243/status
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/243/cmdline
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/2/status
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/2/cmdline
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/123/status
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/123/cmdline
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/244/status
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/244/cmdline
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/1589/status
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/1589/cmdline
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/3/status
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/3/cmdline
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/124/status
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/124/cmdline
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/245/status
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/245/cmdline
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/1588/status
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/1588/cmdline
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/125/status
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/125/cmdline
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/4/status
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/4/cmdline
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/246/status
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/246/cmdline
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/3402/status
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/3402/cmdline
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/126/status
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/126/cmdline
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/5/status
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/5/cmdline
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/247/status
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/247/cmdline
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/127/status
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/127/cmdline
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/6/status
Source: /usr/bin/pkill (PID: 5661)	File opened: /proc/6/cmdline

Source: /tmp/yakuza.x86.elf (PID: 5541)	Shell command executed: sh -c "pkill -9 902i13 \|\| busybox pkill -9 902i13"	Jump to behavior
Source: /tmp/yakuza.x86.elf (PID: 5546)	Shell command executed: sh -c "pkill -9 BzSxLxBxeY \|\| busybox pkill -9 BzSxLxBxeY"	Jump to behavior
Source: /tmp/yakuza.x86.elf (PID: 5549)	Shell command executed: sh -c "pkill -9 HOHO-LUGO7 \|\| busybox pkill -9 HOHO-LUGO7"	Jump to behavior
Source: /tmp/yakuza.x86.elf (PID: 5554)	Shell command executed: sh -c "pkill -9 HOHO-U79OL \|\| busybox pkill -9 HOHO-U79OL"	Jump to behavior
Source: /tmp/yakuza.x86.elf (PID: 5557)	Shell command executed: sh -c "pkill -9 JuYfouyf87 \|\| busybox pkill -9 JuYfouyf87"	Jump to behavior
Source: /tmp/yakuza.x86.elf (PID: 5562)	Shell command executed: sh -c "pkill -9 NiGGeR69xd \|\| busybox pkill -9 NiGGeR69xd"	Jump to behavior
Source: /tmp/yakuza.x86.elf (PID: 5565)	Shell command executed: sh -c "pkill -9 SO190Ij1X \|\| busybox pkill -9 SO190Ij1X"	Jump to behavior
Source: /tmp/yakuza.x86.elf (PID: 5570)	Shell command executed: sh -c "pkill -9 LOLKIKEEEDDE \|\| busybox pkill -9 LOLKIKEEEDDE"	Jump to behavior
Source: /tmp/yakuza.x86.elf (PID: 5573)	Shell command executed: sh -c "pkill -9 ekjheory98e \|\| busybox pkill -9 ekjheory98e"	Jump to behavior
Source: /tmp/yakuza.x86.elf (PID: 5597)	Shell command executed: sh -c "pkill -9 scansh4 \|\| busybox pkill -9 scansh4"	Jump to behavior
Source: /tmp/yakuza.x86.elf (PID: 5600)	Shell command executed: sh -c "pkill -9 MDMA \|\| busybox pkill -9 MDMA"	Jump to behavior
Source: /tmp/yakuza.x86.elf (PID: 5604)	Shell command executed: sh -c "pkill -9 fdevalvex \|\| busybox pkill -9 fdevalvex"	Jump to behavior
Source: /tmp/yakuza.x86.elf (PID: 5609)	Shell command executed: sh -c "pkill -9 scanspc \|\| busybox pkill -9 scanspc"	Jump to behavior
Source: /tmp/yakuza.x86.elf (PID: 5612)	Shell command executed: sh -c "pkill -9 MELTEDNINJAREALZ \|\| busybox pkill -9 MELTEDNINJAREALZ"	Jump to behavior
Source: /tmp/yakuza.x86.elf (PID: 5617)	Shell command executed: sh -c "pkill -9 flexsonskids \|\| busybox pkill -9 flexsonskids"	Jump to behavior
Source: /tmp/yakuza.x86.elf (PID: 5620)	Shell command executed: sh -c "pkill -9 scanx86 \|\| busybox pkill -9 scanx86"
Source: /tmp/yakuza.x86.elf (PID: 5625)	Shell command executed: sh -c "pkill -9 MISAKI-U79OL \|\| busybox pkill -9 MISAKI-U79OL"
Source: /tmp/yakuza.x86.elf (PID: 5628)	Shell command executed: sh -c "pkill -9 foAxi102kxe \|\| busybox pkill -9 foAxi102kxe"
Source: /tmp/yakuza.x86.elf (PID: 5633)	Shell command executed: sh -c "pkill -9 swodjwodjwoj \|\| busybox pkill -9 swodjwodjwoj"
Source: /tmp/yakuza.x86.elf (PID: 5636)	Shell command executed: sh -c "pkill -9 MmKiy7f87l \|\| busybox pkill -9 MmKiy7f87l"
Source: /tmp/yakuza.x86.elf (PID: 5641)	Shell command executed: sh -c "pkill -9 freecookiex86 \|\| busybox pkill -9 freecookiex86"
Source: /tmp/yakuza.x86.elf (PID: 5644)	Shell command executed: sh -c "pkill -9 sysgpu \|\| busybox pkill -9 sysgpu"
Source: /tmp/yakuza.x86.elf (PID: 5651)	Shell command executed: sh -c "pkill -9 NiGGeR69xd \|\| busybox pkill -9 NiGGeR69xd"
Source: /tmp/yakuza.x86.elf (PID: 5654)	Shell command executed: sh -c "pkill -9 frgege \|\| busybox pkill -9 frgege"
Source: /tmp/yakuza.x86.elf (PID: 5660)	Shell command executed: sh -c "pkill -9 sysupdater \|\| busybox pkill -9 sysupdater"
Source: /tmp/yakuza.x86.elf (PID: 5663)	Shell command executed: sh -c "pkill -9 0DnAzepd \|\| busybox pkill -9 0DnAzepd"
Source: /tmp/yakuza.x86.elf (PID: 5668)	Shell command executed: sh -c "pkill -9 NiGGeRD0nks69 \|\| busybox pkill -9 NiGGeRD0nks69"
Source: /tmp/yakuza.x86.elf (PID: 5671)	Shell command executed: sh -c "pkill -9 frgreu \|\| busybox pkill -9 frgreu"
Source: /tmp/yakuza.x86.elf (PID: 5676)	Shell command executed: sh -c "pkill -9 telnetd \|\| busybox pkill -9 telnetd"
Source: /tmp/yakuza.x86.elf (PID: 5679)	Shell command executed: sh -c "pkill -9 0x766f6964 \|\| busybox pkill -9 0x766f6964"
Source: /tmp/yakuza.x86.elf (PID: 5682)	Shell command executed: sh -c "pkill -9 NiGGeRd0nks1337 \|\| busybox pkill -9 NiGGeRd0nks1337"
Source: /tmp/yakuza.x86.elf (PID: 5687)	Shell command executed: sh -c "pkill -9 gaft \|\| busybox pkill -9 gaft"
Source: /tmp/yakuza.x86.elf (PID: 5690)	Shell command executed: sh -c "pkill -9 urasgbsigboa \|\| busybox pkill -9 urasgbsigboa"
Source: /tmp/yakuza.x86.elf (PID: 5695)	Shell command executed: sh -c "pkill -9 120i3UI49 \|\| busybox pkill -9 120i3UI49"
Source: /tmp/yakuza.x86.elf (PID: 5698)	Shell command executed: sh -c "pkill -9 OaF3 \|\| busybox pkill -9 OaF3"
Source: /tmp/yakuza.x86.elf (PID: 5703)	Shell command executed: sh -c "pkill -9 geae \|\| busybox pkill -9 geae"
Source: /tmp/yakuza.x86.elf (PID: 5706)	Shell command executed: sh -c "pkill -9 vaiolmao \|\| busybox pkill -9 vaiolmao"
Source: /tmp/yakuza.x86.elf (PID: 5712)	Shell command executed: sh -c "pkill -9 123123a \|\| busybox pkill -9 123123a"
Source: /tmp/yakuza.x86.elf (PID: 5715)	Shell command executed: sh -c "pkill -9 Ofurain0n4H34D \|\| busybox pkill -9 Ofurain0n4H34D"
Source: /tmp/yakuza.x86.elf (PID: 5720)	Shell command executed: sh -c "pkill -9 ggTrex \|\| busybox pkill -9 ggTrex"
Source: /tmp/yakuza.x86.elf (PID: 5723)	Shell command executed: sh -c "pkill -9 wasads \|\| busybox pkill -9 wasads"
Source: /tmp/yakuza.x86.elf (PID: 5728)	Shell command executed: sh -c "pkill -9 1293194hjXD \|\| busybox pkill -9 1293194hjXD"
Source: /tmp/yakuza.x86.elf (PID: 5731)	Shell command executed: sh -c "pkill -9 OthLaLosn \|\| busybox pkill -9 OthLaLosn"
Source: /tmp/yakuza.x86.elf (PID: 5736)	Shell command executed: sh -c "pkill -9 ggt \|\| busybox pkill -9 ggt"
Source: /tmp/yakuza.x86.elf (PID: 5739)	Shell command executed: sh -c "pkill -9 wget-log \|\| busybox pkill -9 wget-log"
Source: /tmp/yakuza.x86.elf (PID: 5744)	Shell command executed: sh -c "pkill -9 1337SoraLOADER \|\| busybox pkill -9 1337SoraLOADER"
Source: /tmp/yakuza.x86.elf (PID: 5747)	Shell command executed: sh -c "pkill -9 SAIAKINA \|\| busybox pkill -9 SAIAKINA"
Source: /tmp/yakuza.x86.elf (PID: 5754)	Shell command executed: sh -c "pkill -9 ggtq \|\| busybox pkill -9 ggtq"
Source: /tmp/yakuza.x86.elf (PID: 5757)	Shell command executed: sh -c "pkill -9 1378bfp919GRB1Q2 \|\| busybox pkill -9 1378bfp919GRB1Q2"
Source: /tmp/yakuza.x86.elf (PID: 5763)	Shell command executed: sh -c "pkill -9 SAIAKUSO \|\| busybox pkill -9 SAIAKUSO"
Source: /tmp/yakuza.x86.elf (PID: 5766)	Shell command executed: sh -c "pkill -9 ggtr \|\| busybox pkill -9 ggtr"
Source: /tmp/yakuza.x86.elf (PID: 5771)	Shell command executed: sh -c "pkill -9 14Fa \|\| busybox pkill -9 14Fa"
Source: /tmp/yakuza.x86.elf (PID: 5774)	Shell command executed: sh -c "pkill -9 SEXSLAVE1337 \|\| busybox pkill -9 SEXSLAVE1337"

Source: /bin/sh (PID: 5542)	Pkill executable: /usr/bin/pkill -> pkill -9 902i13	Jump to behavior
Source: /bin/sh (PID: 5547)	Pkill executable: /usr/bin/pkill -> pkill -9 BzSxLxBxeY	Jump to behavior
Source: /bin/sh (PID: 5550)	Pkill executable: /usr/bin/pkill -> pkill -9 HOHO-LUGO7	Jump to behavior
Source: /bin/sh (PID: 5555)	Pkill executable: /usr/bin/pkill -> pkill -9 HOHO-U79OL	Jump to behavior
Source: /bin/sh (PID: 5558)	Pkill executable: /usr/bin/pkill -> pkill -9 JuYfouyf87	Jump to behavior
Source: /bin/sh (PID: 5563)	Pkill executable: /usr/bin/pkill -> pkill -9 NiGGeR69xd	Jump to behavior
Source: /bin/sh (PID: 5566)	Pkill executable: /usr/bin/pkill -> pkill -9 SO190Ij1X	Jump to behavior
Source: /bin/sh (PID: 5571)	Pkill executable: /usr/bin/pkill -> pkill -9 LOLKIKEEEDDE	Jump to behavior
Source: /bin/sh (PID: 5574)	Pkill executable: /usr/bin/pkill -> pkill -9 ekjheory98e	Jump to behavior
Source: /bin/sh (PID: 5598)	Pkill executable: /usr/bin/pkill -> pkill -9 scansh4	Jump to behavior
Source: /bin/sh (PID: 5601)	Pkill executable: /usr/bin/pkill -> pkill -9 MDMA	Jump to behavior
Source: /bin/sh (PID: 5605)	Pkill executable: /usr/bin/pkill -> pkill -9 fdevalvex	Jump to behavior
Source: /bin/sh (PID: 5610)	Pkill executable: /usr/bin/pkill -> pkill -9 scanspc	Jump to behavior
Source: /bin/sh (PID: 5613)	Pkill executable: /usr/bin/pkill -> pkill -9 MELTEDNINJAREALZ	Jump to behavior
Source: /bin/sh (PID: 5618)	Pkill executable: /usr/bin/pkill -> pkill -9 flexsonskids	Jump to behavior
Source: /bin/sh (PID: 5621)	Pkill executable: /usr/bin/pkill -> pkill -9 scanx86
Source: /bin/sh (PID: 5626)	Pkill executable: /usr/bin/pkill -> pkill -9 MISAKI-U79OL
Source: /bin/sh (PID: 5629)	Pkill executable: /usr/bin/pkill -> pkill -9 foAxi102kxe
Source: /bin/sh (PID: 5634)	Pkill executable: /usr/bin/pkill -> pkill -9 swodjwodjwoj
Source: /bin/sh (PID: 5637)	Pkill executable: /usr/bin/pkill -> pkill -9 MmKiy7f87l
Source: /bin/sh (PID: 5642)	Pkill executable: /usr/bin/pkill -> pkill -9 freecookiex86
Source: /bin/sh (PID: 5645)	Pkill executable: /usr/bin/pkill -> pkill -9 sysgpu
Source: /bin/sh (PID: 5652)	Pkill executable: /usr/bin/pkill -> pkill -9 NiGGeR69xd
Source: /bin/sh (PID: 5655)	Pkill executable: /usr/bin/pkill -> pkill -9 frgege
Source: /bin/sh (PID: 5661)	Pkill executable: /usr/bin/pkill -> pkill -9 sysupdater
Source: /bin/sh (PID: 5664)	Pkill executable: /usr/bin/pkill -> pkill -9 0DnAzepd
Source: /bin/sh (PID: 5669)	Pkill executable: /usr/bin/pkill -> pkill -9 NiGGeRD0nks69
Source: /bin/sh (PID: 5672)	Pkill executable: /usr/bin/pkill -> pkill -9 frgreu
Source: /bin/sh (PID: 5677)	Pkill executable: /usr/bin/pkill -> pkill -9 telnetd
Source: /bin/sh (PID: 5680)	Pkill executable: /usr/bin/pkill -> pkill -9 0x766f6964
Source: /bin/sh (PID: 5683)	Pkill executable: /usr/bin/pkill -> pkill -9 NiGGeRd0nks1337
Source: /bin/sh (PID: 5688)	Pkill executable: /usr/bin/pkill -> pkill -9 gaft
Source: /bin/sh (PID: 5691)	Pkill executable: /usr/bin/pkill -> pkill -9 urasgbsigboa
Source: /bin/sh (PID: 5696)	Pkill executable: /usr/bin/pkill -> pkill -9 120i3UI49
Source: /bin/sh (PID: 5699)	Pkill executable: /usr/bin/pkill -> pkill -9 OaF3
Source: /bin/sh (PID: 5704)	Pkill executable: /usr/bin/pkill -> pkill -9 geae
Source: /bin/sh (PID: 5707)	Pkill executable: /usr/bin/pkill -> pkill -9 vaiolmao
Source: /bin/sh (PID: 5713)	Pkill executable: /usr/bin/pkill -> pkill -9 123123a
Source: /bin/sh (PID: 5716)	Pkill executable: /usr/bin/pkill -> pkill -9 Ofurain0n4H34D
Source: /bin/sh (PID: 5721)	Pkill executable: /usr/bin/pkill -> pkill -9 ggTrex
Source: /bin/sh (PID: 5724)	Pkill executable: /usr/bin/pkill -> pkill -9 wasads
Source: /bin/sh (PID: 5729)	Pkill executable: /usr/bin/pkill -> pkill -9 1293194hjXD
Source: /bin/sh (PID: 5732)	Pkill executable: /usr/bin/pkill -> pkill -9 OthLaLosn
Source: /bin/sh (PID: 5737)	Pkill executable: /usr/bin/pkill -> pkill -9 ggt
Source: /bin/sh (PID: 5740)	Pkill executable: /usr/bin/pkill -> pkill -9 wget-log
Source: /bin/sh (PID: 5745)	Pkill executable: /usr/bin/pkill -> pkill -9 1337SoraLOADER
Source: /bin/sh (PID: 5748)	Pkill executable: /usr/bin/pkill -> pkill -9 SAIAKINA
Source: /bin/sh (PID: 5755)	Pkill executable: /usr/bin/pkill -> pkill -9 ggtq
Source: /bin/sh (PID: 5758)	Pkill executable: /usr/bin/pkill -> pkill -9 1378bfp919GRB1Q2
Source: /bin/sh (PID: 5764)	Pkill executable: /usr/bin/pkill -> pkill -9 SAIAKUSO
Source: /bin/sh (PID: 5767)	Pkill executable: /usr/bin/pkill -> pkill -9 ggtr
Source: /bin/sh (PID: 5772)	Pkill executable: /usr/bin/pkill -> pkill -9 14Fa
Source: /bin/sh (PID: 5775)	Pkill executable: /usr/bin/pkill -> pkill -9 SEXSLAVE1337

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown	Network traffic detected: IRC traffic on port 56980 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 56982 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 56984 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 56986 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 56988 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 56990 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 56992 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 56994 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 56996 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 56998 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 57000 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 57002 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 57004 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 57006 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 57008 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 57010 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 57012 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 57014 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 57016 -> 6780
Source: unknown	Network traffic detected: IRC traffic on port 57018 -> 6780

Source: /usr/bin/pkill (PID: 5542)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5547)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5550)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5555)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5558)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5563)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5566)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5571)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5574)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5598)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5601)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5605)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5610)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5613)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 5618)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5621)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5626)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5629)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5634)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5637)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5642)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5645)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5652)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5655)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5661)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5664)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5669)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5672)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5677)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5680)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5683)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5688)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5691)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5696)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5699)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5704)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5707)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5713)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5716)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5721)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5724)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5729)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5732)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5737)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5740)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5745)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5748)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5755)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5758)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5764)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5767)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5772)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 5775)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Source: /usr/bin/busybox (PID: 5543)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5548)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5551)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5556)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5559)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5564)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5567)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5572)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5575)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5599)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5602)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5608)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5611)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5616)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 5619)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5624)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5627)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5632)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5635)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5640)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5643)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5648)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5653)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5657)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5662)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5665)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5670)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5673)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5678)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5681)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5686)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5689)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5694)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5697)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5702)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5705)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5709)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5714)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5717)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5722)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5725)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5730)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5733)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5738)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5741)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5746)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5751)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5756)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5760)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5765)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5768)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 5773)	Queries kernel information via 'uname':

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: yakuza.x86.elf, type: SAMPLE
Source: Yara match	File source: 5537.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY

Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:48.0) Gecko/20100101 Firefox/48.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en; rv:1.8.1.11) Gecko/20071128 Camino/1.5.4
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; rv:2.2) Gecko/20110201
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; cs; rv:1.9.2.6) Gecko/20100628 myibrow/4alpha2
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Win 9x 4.90; SG; rv:1.9.2.4) Gecko/20101104 Netscape/9.1.0285
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.2.0 Lightning/4.0.2
Source: Initial sample	User agent string found: Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U;) Presto/2.7.62 Version/11.01
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; Linux x86_64; U; de; rv:1.9.1.6) Gecko/20091201 Firefox/3.5.6 Opera 10.62
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Linux; Android 4.4.3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.89 Mobile Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0) Gecko/20110517 Firefox/5.0 Fennec/5.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Android; Linux armv7l; rv:9.0) Gecko/20111216 Firefox/9.0 Fennec/9.0
Source: Initial sample	User agent string found: Mozilla/5.0 (compatible; Teleca Q7; Brew 3.1.5; U; en) 480X800 LGE VX11000

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: yakuza.x86.elf, type: SAMPLE
Source: Yara match	File source: 5537.1.0000000000400000.0000000000419000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 Masquerading	1 OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	1 Brute Force	1 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	11 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
yakuza.x86.elf	63%	ReversingLabs	Linux.Trojan.Tsunami
yakuza.x86.elf	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://youtu.be/dQw4w9WgXcQ	yakuza.x86.elf	false	high
http://linux-it.abuser.eu/yak.sh;	yakuza.x86.elf	false	unknown
https://youtu.be/dQw4w9WgXcQNever	yakuza.x86.elf	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
95.234.158.87	unknown	Italy		3269	ASN-IBSNAZIT	true

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
95.234.158.87	yakuza.m68k.elf	Get hash	malicious	Mirai	Browse
	yakuza.arm7.elf	Get hash	malicious	Mirai	Browse
	yakuza.ppc.elf	Get hash	malicious	Mirai	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ASN-IBSNAZIT	yakuza.m68k.elf	Get hash	malicious	Mirai	Browse	95.234.158.87
	yakuza.arm7.elf	Get hash	malicious	Mirai	Browse	95.234.158.87
	yakuza.ppc.elf	Get hash	malicious	Mirai	Browse	95.234.158.87
	sparc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	131.1.112.117
	sh4.elf	Get hash	malicious	Mirai, Moobot	Browse	79.16.25.108
	mpsl.elf	Get hash	malicious	Mirai, Moobot	Browse	95.224.165.124
	powerpc.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	79.58.184.246
	mips.elf	Get hash	malicious	Mirai, Moobot	Browse	79.39.13.191
	arm.elf	Get hash	malicious	Mirai, Moobot	Browse	2.114.140.56
	m68k.elf	Get hash	malicious	Mirai, Moobot	Browse	87.16.92.237

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, not stripped
Entropy (8bit):	6.0169374063006344
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	yakuza.x86.elf
File size:	142'929 bytes
MD5:	86ae7faf59555791f91c85614824d7fc
SHA1:	77182d8944b2d96bd8f7e50e6a056c23f6be0127
SHA256:	e801f5c7f5b523fd52eff6502bb1805bced37cb26f77f36d8de0df2e9a8e78e0
SHA512:	31e0c863ce8a975d370587f3d2abc32b5a2e7ab9c85d7f88390495e6dc61e7b292340b62a853ceccdcaa746e5bd4174457e5c8183e9bfadb8e5cc2193cbb3202
SSDEEP:	3072:dSk35JBxR4HUHTyquWNpHzLT6bG77kxM5ZZIrv1FjP3+9/NJMHI:QkplHznEM5Cv1FjP3+JNJMHI
TLSH:	6ED34A13B5D2CDFFC0A796F50BDB9265A823F4390B3A215723A47DA92F0E9C91D2D210
File Content Preview:	.ELF..............>.......@.....@...................@.8...@.......................@.......@.....L.......L.......................P.......P.Q.....P.Q.....8.......................Q.td....................................................H...._....J)..H........

Static ELF Info

ELF header
Class:	ELF64
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Advanced Micro Devices X86-64
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x400194
Flags:	0x0
ELF Header Size:	64
Program Header Offset:	64
Program Header Size:	56
Number of Program Headers:	3
Section Header Offset:	109480
Section Header Size:	64
Number of Section Headers:	15
Header String Table Index:	12

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x4000e8	0xe8	0x13	0x0	0x6	AX	0	0	1
.text	PROGBITS	0x400100	0x100	0x12978	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x412a78	0x12a78	0xe	0x0	0x6	AX	0	0	1
.rodata	PROGBITS	0x412aa0	0x12aa0	0x5aa6	0x0	0x2	A	0	0	32
.eh_frame	PROGBITS	0x418548	0x18548	0x4	0x0	0x2	A	0	0	4
.ctors	PROGBITS	0x518550	0x18550	0x10	0x0	0x3	WA	0	0	8
.dtors	PROGBITS	0x518560	0x18560	0x10	0x0	0x3	WA	0	0	8
.jcr	PROGBITS	0x518570	0x18570	0x8	0x0	0x3	WA	0	0	8
.data	PROGBITS	0x518580	0x18580	0x1908	0x0	0x3	WA	0	0	32
.bss	NOBITS	0x519ea0	0x19e88	0x8090	0x0	0x3	WA	0	0	32
.comment	PROGBITS	0x0	0x19e88	0xcba	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x1ab42	0x66	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x1af68	0x5508	0x18	0x0		14	292	8
.strtab	STRTAB	0x0	0x20470	0x29e1	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x400000	0x400000	0x1854c	0x1854c	6.4356	0x5	R E	0x100000	.init .text .fini .rodata .eh_frame
LOAD	0x18550	0x518550	0x518550	0x1938	0x99e0	2.7396	0x6	RW	0x100000	.ctors .dtors .jcr .data .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x8

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x4000e8	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x400100	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x412a78	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x412aa0	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x418548	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x518550	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x518560	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x518570	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x518580	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x519ea0	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	14
C.75.6124	.symtab	0x414d80	624	OBJECT	<unknown>	DEFAULT	4
ClearHistory	.symtab	0x40644c	36	FUNC	<unknown>	DEFAULT	2
HTTP	.symtab	0x40237e	276	FUNC	<unknown>	DEFAULT	2
Q	.symtab	0x51a360	16384	OBJECT	<unknown>	DEFAULT	10
Send	.symtab	0x40037f	286	FUNC	<unknown>	DEFAULT	2
UserAgents	.symtab	0x518c20	288	OBJECT	<unknown>	DEFAULT	9
_352	.symtab	0x40797a	17	FUNC	<unknown>	DEFAULT	2
_376	.symtab	0x4078d6	121	FUNC	<unknown>	DEFAULT	2
_433	.symtab	0x40798b	62	FUNC	<unknown>	DEFAULT	2
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_NICK	.symtab	0x4079c9	196	FUNC	<unknown>	DEFAULT	2
_PING	.symtab	0x40794f	43	FUNC	<unknown>	DEFAULT	2
_PRIVMSG	.symtab	0x406e41	2709	FUNC	<unknown>	DEFAULT	2
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x518558	0	OBJECT	<unknown>	DEFAULT	6
__CTOR_LIST__	.symtab	0x518550	0	OBJECT	<unknown>	DEFAULT	6
__C_ctype_b	.symtab	0x519df0	8	OBJECT	<unknown>	DEFAULT	9
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x417d80	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x519e00	8	OBJECT	<unknown>	DEFAULT	9
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x418080	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x5199e0	8	OBJECT	<unknown>	DEFAULT	9
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x416800	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x518568	0	OBJECT	<unknown>	DEFAULT	7
__DTOR_LIST__	.symtab	0x518560	0	OBJECT	<unknown>	DEFAULT	7
__EH_FRAME_BEGIN__	.symtab	0x418548	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x418548	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x519df0	8	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_b_data	.symtab	0x417d80	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_tolower	.symtab	0x519e00	8	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_tolower_data	.symtab	0x418080	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_toupper	.symtab	0x5199e0	8	OBJECT	<unknown>	HIDDEN	9
__GI___C_ctype_toupper_data	.symtab	0x416800	768	OBJECT	<unknown>	HIDDEN	4
__GI___ctype_b	.symtab	0x519df8	8	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_tolower	.symtab	0x519e08	8	OBJECT	<unknown>	HIDDEN	9
__GI___ctype_toupper	.symtab	0x5199e8	8	OBJECT	<unknown>	HIDDEN	9
__GI___errno_location	.symtab	0x408ab8	6	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x40fcd0	222	FUNC	<unknown>	HIDDEN	2
__GI___fputc_unlocked	.symtab	0x40a82c	192	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x40aec8	14	FUNC	<unknown>	HIDDEN	2
__GI___h_errno_location	.symtab	0x40f1f8	6	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x4086a4	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_lseek	.symtab	0x412900	45	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x40f064	106	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x40eaa8	70	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x40eb27	67	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x40aed8	194	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x40ee9c	42	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x40de24	276	FUNC	<unknown>	HIDDEN	2
__GI_accept	.symtab	0x40cc28	41	FUNC	<unknown>	HIDDEN	2
__GI_asprintf	.symtab	0x408d24	142	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x40e458	18	FUNC	<unknown>	HIDDEN	2
__GI_atol	.symtab	0x40e46c	12	FUNC	<unknown>	HIDDEN	2
__GI_bind	.symtab	0x40cc54	43	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x411d90	43	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0x408708	38	FUNC	<unknown>	HIDDEN	2
__GI_clock_getres	.symtab	0x40eec8	41	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x408730	41	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x40cc80	43	FUNC	<unknown>	HIDDEN	2
__GI_dup2	.symtab	0x40eef4	44	FUNC	<unknown>	HIDDEN	2
__GI_endservent	.symtab	0x410712	90	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x52041c	4	OBJECT	<unknown>	HIDDEN	10
__GI_execl	.symtab	0x40e654	287	FUNC	<unknown>	HIDDEN	2
__GI_execve	.symtab	0x40ef20	38	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x40e5f8	92	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x408ac0	259	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x4086a4	100	FUNC	<unknown>	HIDDEN	2
__GI_fcntl64	.symtab	0x4086a4	100	FUNC	<unknown>	HIDDEN	2
__GI_fdopen	.symtab	0x40f2e0	54	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x40a66c	329	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x40fcd0	222	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x40a42c	109	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x40a7b8	116	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x408bc4	10	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x40875c	38	FUNC	<unknown>	HIDDEN	2
__GI_fprintf	.symtab	0x408c94	142	FUNC	<unknown>	HIDDEN	2
__GI_fputc	.symtab	0x40a49c	146	FUNC	<unknown>	HIDDEN	2
__GI_fputs	.symtab	0x40a530	97	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x40a8ec	56	FUNC	<unknown>	HIDDEN	2
__GI_freeaddrinfo	.symtab	0x40bc59	22	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x411dd4	5	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x411e38	218	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x40a924	134	FUNC	<unknown>	HIDDEN	2
__GI_getaddrinfo	.symtab	0x40bc6f	697	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x40fcd0	222	FUNC	<unknown>	HIDDEN	2
__GI_getcwd	.symtab	0x408784	203	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x408850	35	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x40ef48	38	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x40ef70	38	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x40ef98	38	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyaddr_r	.symtab	0x40c878	944	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2_r	.symtab	0x40c538	829	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x4118ac	897	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x408874	19	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x408888	38	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x4088d8	40	FUNC	<unknown>	HIDDEN	2
__GI_getservbyname_r	.symtab	0x4108dc	233	FUNC	<unknown>	HIDDEN	2
__GI_getservbyport	.symtab	0x41089b	65	FUNC	<unknown>	HIDDEN	2
__GI_getservbyport_r	.symtab	0x4107df	188	FUNC	<unknown>	HIDDEN	2
__GI_getservent_r	.symtab	0x4104ff	485	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x40efc0	38	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x520420	4	OBJECT	<unknown>	HIDDEN	10
__GI_if_freenameindex	.symtab	0x410c9a	48	FUNC	<unknown>	HIDDEN	2
__GI_if_nameindex	.symtab	0x410af0	426	FUNC	<unknown>	HIDDEN	2
__GI_if_nametoindex	.symtab	0x410a7d	115	FUNC	<unknown>	HIDDEN	2
__GI_in6addr_loopback	.symtab	0x417840	16	OBJECT	<unknown>	HIDDEN	4
__GI_inet_addr	.symtab	0x40c51c	28	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x410ccc	137	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa	.symtab	0x40c511	10	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa_r	.symtab	0x40c4c4	77	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x40c2b4	527	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x40bfaf	493	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x40e24f	185	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x408900	104	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x40b068	25	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x408968	44	FUNC	<unknown>	HIDDEN	2
__GI_listen	.symtab	0x40cce0	44	FUNC	<unknown>	HIDDEN	2
__GI_lseek	.symtab	0x412900	45	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x4128f8	5	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x40ffb4	240	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x40a9b0	102	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x4100a4	734	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x40fdb0	90	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x410384	237	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x40aa20	210	FUNC	<unknown>	HIDDEN	2
__GI_mmap	.symtab	0x40ee54	48	FUNC	<unknown>	HIDDEN	2
__GI_mremap	.symtab	0x40efe8	42	FUNC	<unknown>	HIDDEN	2
__GI_munmap	.symtab	0x40f014	38	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x40f03c	38	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x40f064	106	FUNC	<unknown>	HIDDEN	2
__GI_perror	.symtab	0x408bd0	45	FUNC	<unknown>	HIDDEN	2
__GI_pipe	.symtab	0x40f0dc	38	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x408994	41	FUNC	<unknown>	HIDDEN	2
__GI_putc	.symtab	0x40a49c	146	FUNC	<unknown>	HIDDEN	2
__GI_putc_unlocked	.symtab	0x40a82c	192	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x411c60	18	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x40df44	72	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x40e14c	90	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x4121b8	190	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x412930	39	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x40cd0c	11	FUNC	<unknown>	HIDDEN	2
__GI_recvfrom	.symtab	0x40cd18	45	FUNC	<unknown>	HIDDEN	2
__GI_rewind	.symtab	0x411ddc	92	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x40f104	74	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x4089c0	44	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x40cd48	11	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x40cd54	48	FUNC	<unknown>	HIDDEN	2
__GI_setservent	.symtab	0x41076c	115	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x4089ec	38	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x40cd84	53	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x40e0a4	168	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x40ed5d	247	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x411c74	168	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x40f150	85	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x40e774	415	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x40cdbc	47	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x408db4	149	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x40e1a6	169	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x40afac	48	FUNC	<unknown>	HIDDEN	2
__GI_strcasestr	.symtab	0x40afdc	70	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x40fe10	417	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x41207c	33	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x41207c	33	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x40ab00	213	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x40b024	54	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x40abe0	225	FUNC	<unknown>	HIDDEN	2
__GI_strncat	.symtab	0x412278	119	FUNC	<unknown>	HIDDEN	2
__GI_strncmp	.symtab	0x40acc4	176	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x40ad74	131	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x40adf8	206	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x4120a0	140	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x412130	135	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x40b05c	10	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x410474	94	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x40e478	10	FUNC	<unknown>	HIDDEN	2
__GI_strtoll	.symtab	0x40e478	10	FUNC	<unknown>	HIDDEN	2
__GI_strtoul	.symtab	0x40e484	7	FUNC	<unknown>	HIDDEN	2
__GI_strtoull	.symtab	0x40e484	7	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x40e914	351	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x40b084	110	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x408a14	39	FUNC	<unknown>	HIDDEN	2
__GI_tolower	.symtab	0x40f1d8	30	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x408a98	30	FUNC	<unknown>	HIDDEN	2
__GI_vasprintf	.symtab	0x408e4c	146	FUNC	<unknown>	HIDDEN	2
__GI_vfork	.symtab	0x40ee84	21	FUNC	<unknown>	HIDDEN	2
__GI_vfprintf	.symtab	0x4095a0	143	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x408ee0	199	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x40f1a8	47	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x408a64	7	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x40f200	68	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x40f254	140	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x40f244	15	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x408a6c	42	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x518570	0	OBJECT	<unknown>	DEFAULT	8
__JCR_LIST__	.symtab	0x518570	0	OBJECT	<unknown>	DEFAULT	8
__app_fini	.symtab	0x520408	8	OBJECT	<unknown>	HIDDEN	10
__atexit_lock	.symtab	0x519dc0	40	OBJECT	<unknown>	DEFAULT	9
__bsd_signal	.symtab	0x411c74	168	FUNC	<unknown>	HIDDEN	2
__bss_start	.symtab	0x519e88	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x40eaf2	53	FUNC	<unknown>	DEFAULT	2
__ctype_b	.symtab	0x519df8	8	OBJECT	<unknown>	DEFAULT	9
__ctype_tolower	.symtab	0x519e08	8	OBJECT	<unknown>	DEFAULT	9
__ctype_toupper	.symtab	0x5199e8	8	OBJECT	<unknown>	DEFAULT	9
__curbrk	.symtab	0x5204d0	8	OBJECT	<unknown>	HIDDEN	10
__data_start	.symtab	0x518590	0	NOTYPE	<unknown>	DEFAULT	9
__decode_answer	.symtab	0x41249c	242	FUNC	<unknown>	HIDDEN	2
__decode_dotted	.symtab	0x410d58	246	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x412394	161	FUNC	<unknown>	HIDDEN	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__dns_lookup	.symtab	0x410e50	1862	FUNC	<unknown>	HIDDEN	2
__do_global_ctors_aux	.symtab	0x412a40	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x400100	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x518580	0	OBJECT	<unknown>	HIDDEN	9
__encode_dotted	.symtab	0x412958	160	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x4122f0	163	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x412438	80	FUNC	<unknown>	HIDDEN	2
__environ	.symtab	0x5203f8	8	OBJECT	<unknown>	DEFAULT	10
__errno_location	.symtab	0x408ab8	6	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x5203e8	8	OBJECT	<unknown>	HIDDEN	10
__fgetc_unlocked	.symtab	0x40fcd0	222	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x51854c	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fini_array_start	.symtab	0x51854c	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fputc_unlocked	.symtab	0x40a82c	192	FUNC	<unknown>	DEFAULT	2
__get_hosts_byaddr_r	.symtab	0x411820	138	FUNC	<unknown>	HIDDEN	2
__get_hosts_byname_r	.symtab	0x4117f0	48	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x408874	19	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x40aec8	14	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__h_errno_location	.symtab	0x40f1f8	6	FUNC	<unknown>	DEFAULT	2
__h_errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__init_array_end	.symtab	0x51854c	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__init_array_start	.symtab	0x51854c	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__initbuf	.symtab	0x4104d4	43	FUNC	<unknown>	DEFAULT	2
__length_dotted	.symtab	0x4129f8	59	FUNC	<unknown>	HIDDEN	2
__length_question	.symtab	0x412488	19	FUNC	<unknown>	HIDDEN	2
__libc_accept	.symtab	0x40cc28	41	FUNC	<unknown>	DEFAULT	2
__libc_close	.symtab	0x408730	41	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x40cc80	43	FUNC	<unknown>	DEFAULT	2
__libc_creat	.symtab	0x40f0ce	14	FUNC	<unknown>	DEFAULT	2
__libc_fcntl	.symtab	0x4086a4	100	FUNC	<unknown>	DEFAULT	2
__libc_fcntl64	.symtab	0x4086a4	100	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x40875c	38	FUNC	<unknown>	DEFAULT	2
__libc_getpid	.symtab	0x408888	38	FUNC	<unknown>	DEFAULT	2
__libc_lseek	.symtab	0x412900	45	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0x4128f8	5	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x40f03c	38	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x40f064	106	FUNC	<unknown>	DEFAULT	2
__libc_poll	.symtab	0x408994	41	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x412930	39	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x40cd0c	11	FUNC	<unknown>	DEFAULT	2
__libc_recvfrom	.symtab	0x40cd18	45	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x4089c0	44	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x40cd48	11	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x40cd54	48	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x40ed5d	247	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x5203f0	8	OBJECT	<unknown>	DEFAULT	10
__libc_system	.symtab	0x40e308	335	FUNC	<unknown>	DEFAULT	2
__libc_waitpid	.symtab	0x408a64	7	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x408a6c	42	FUNC	<unknown>	DEFAULT	2
__malloc_consolidate	.symtab	0x40daa9	410	FUNC	<unknown>	HIDDEN	2
__malloc_largebin_index	.symtab	0x40cdec	96	FUNC	<unknown>	DEFAULT	2
__malloc_lock	.symtab	0x519c40	40	OBJECT	<unknown>	DEFAULT	9
__malloc_state	.symtab	0x521780	1752	OBJECT	<unknown>	DEFAULT	10
__malloc_trim	.symtab	0x40da10	153	FUNC	<unknown>	DEFAULT	2
__nameserver	.symtab	0x521e80	24	OBJECT	<unknown>	HIDDEN	10
__nameservers	.symtab	0x521e98	4	OBJECT	<unknown>	HIDDEN	10
__open_etc_hosts	.symtab	0x412590	42	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x411598	597	FUNC	<unknown>	HIDDEN	2
__opensock	.symtab	0x411c30	45	FUNC	<unknown>	HIDDEN	2
__pagesize	.symtab	0x520400	8	OBJECT	<unknown>	DEFAULT	10
__preinit_array_end	.symtab	0x51854c	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__preinit_array_start	.symtab	0x51854c	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__pthread_initialize_minimal	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x40eaee	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x40eaee	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x40eaee	3	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x40eaee	3	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x40eaee	3	FUNC	<unknown>	DEFAULT	2
__pthread_return_void	.symtab	0x40eaf1	1	FUNC	<unknown>	DEFAULT	2
__raise	.symtab	0x411c60	18	FUNC	<unknown>	HIDDEN	2
__read_etc_hosts_r	.symtab	0x4125ba	830	FUNC	<unknown>	HIDDEN	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__resolv_lock	.symtab	0x519e60	40	OBJECT	<unknown>	DEFAULT	9
__restore_rt	.symtab	0x40ed54	0	NOTYPE	<unknown>	DEFAULT	2
__rtld_fini	.symtab	0x520410	8	OBJECT	<unknown>	HIDDEN	10
__searchdomain	.symtab	0x521e60	32	OBJECT	<unknown>	HIDDEN	10
__searchdomains	.symtab	0x521e9c	4	OBJECT	<unknown>	HIDDEN	10
__sigaddset	.symtab	0x411d3c	28	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x411d58	30	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x411d1c	32	FUNC	<unknown>	DEFAULT	2
__stdin	.symtab	0x519a18	8	OBJECT	<unknown>	DEFAULT	9
__stdio_READ	.symtab	0x411f14	58	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x40f318	147	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x411f50	133	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x40f3ac	259	FUNC	<unknown>	HIDDEN	2
__stdio_init_mutex	.symtab	0x4094df	15	FUNC	<unknown>	HIDDEN	2
__stdio_mutex_initializer.4280	.symtab	0x416b20	40	OBJECT	<unknown>	DEFAULT	4
__stdio_rfill	.symtab	0x411fd8	37	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x41205c	31	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x412000	90	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x40f4b0	148	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x409578	39	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x519a20	8	OBJECT	<unknown>	DEFAULT	9
__syscall_error	.symtab	0x411dbc	22	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uClibc_fini	.symtab	0x40eaa8	70	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x40eb27	67	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x40eb6a	489	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x519de8	8	OBJECT	<unknown>	HIDDEN	9
__vfork	.symtab	0x40ee84	21	FUNC	<unknown>	HIDDEN	2
__xpg_strerror_r	.symtab	0x40aed8	194	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_charpad	.symtab	0x409630	68	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_dl_aux_init	.symtab	0x411d78	23	FUNC	<unknown>	DEFAULT	2
_dl_phdr	.symtab	0x521f20	8	OBJECT	<unknown>	DEFAULT	10
_dl_phnum	.symtab	0x521f28	8	OBJECT	<unknown>	DEFAULT	10
_edata	.symtab	0x519e88	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x521f30	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno	.symtab	0x52041c	4	OBJECT	<unknown>	DEFAULT	10
_exit	.symtab	0x40ee9c	42	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x412a78	5	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x51e3c0	8192	OBJECT	<unknown>	DEFAULT	10
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x409674	120	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x40f688	1608	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_h_errno	.symtab	0x520420	4	OBJECT	<unknown>	DEFAULT	10
_init	.symtab	0x4000e8	5	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x40f544	85	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_init	.symtab	0x409d28	114	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x409fda	1022	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x409d9c	67	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x409de0	457	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x409fac	46	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x40eaf1	1	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x40eaf1	1	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_sigintr	.symtab	0x521ea0	128	OBJECT	<unknown>	HIDDEN	10
_start	.symtab	0x400194	42	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x40924c	551	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x409474	107	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x519a28	8	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_add_lock	.symtab	0x519a40	40	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_dec_use	.symtab	0x40a594	216	FUNC	<unknown>	DEFAULT	2
_stdio_openlist_del_count	.symtab	0x51e3a4	4	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_del_lock	.symtab	0x519a80	40	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_use_count	.symtab	0x51e3a0	4	OBJECT	<unknown>	DEFAULT	10
_stdio_streams	.symtab	0x519ac0	384	OBJECT	<unknown>	DEFAULT	9
_stdio_term	.symtab	0x4094ee	135	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x519aa8	4	OBJECT	<unknown>	DEFAULT	9
_stdlib_strto_l	.symtab	0x40e48c	362	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x40f59c	46	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x416c20	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x40f5cc	187	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x4096ec	1595	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x40de24	276	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
accept	.symtab	0x40cc28	41	FUNC	<unknown>	DEFAULT	2
accept.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
actualparent	.symtab	0x520604	4	OBJECT	<unknown>	DEFAULT	10
advance_telstate	.symtab	0x40481b	83	FUNC	<unknown>	DEFAULT	2
advances	.symtab	0x519680	56	OBJECT	<unknown>	DEFAULT	9
advances2	.symtab	0x519760	88	OBJECT	<unknown>	DEFAULT	9
ak47scan	.symtab	0x406178	172	FUNC	<unknown>	DEFAULT	2
ak47scantoggle	.symtab	0x406224	436	FUNC	<unknown>	DEFAULT	2
ak47telscan	.symtab	0x4048c0	6328	FUNC	<unknown>	DEFAULT	2
append	.symtab	0x406a39	57	FUNC	<unknown>	DEFAULT	2
asprintf	.symtab	0x408d24	142	FUNC	<unknown>	DEFAULT	2
asprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
atoi	.symtab	0x40e458	18	FUNC	<unknown>	DEFAULT	2
atoi.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
atol	.symtab	0x40e46c	12	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
atoll	.symtab	0x40e46c	12	FUNC	<unknown>	DEFAULT	2
bcopy	.symtab	0x40af9c	14	FUNC	<unknown>	DEFAULT	2
bcopy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
been_there_done_that	.symtab	0x5203e0	4	OBJECT	<unknown>	DEFAULT	10
been_there_done_that.3160	.symtab	0x520418	4	OBJECT	<unknown>	DEFAULT	10
bind	.symtab	0x40cc54	43	FUNC	<unknown>	DEFAULT	2
bind.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
blacknurse	.symtab	0x40159c	783	FUNC	<unknown>	DEFAULT	2
botkill	.symtab	0x4063d8	116	FUNC	<unknown>	DEFAULT	2
brk	.symtab	0x411d90	43	FUNC	<unknown>	DEFAULT	2
brk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bsd_signal	.symtab	0x411c74	168	FUNC	<unknown>	DEFAULT	2
buf.2989	.symtab	0x5203d0	16	OBJECT	<unknown>	DEFAULT	10
c	.symtab	0x5197e0	4	OBJECT	<unknown>	DEFAULT	9
capsaicin2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
chan	.symtab	0x521760	8	OBJECT	<unknown>	DEFAULT	10
changeservers	.symtab	0x519f04	4	OBJECT	<unknown>	DEFAULT	10
chdir	.symtab	0x408708	38	FUNC	<unknown>	DEFAULT	2
chdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
clock_getres	.symtab	0x40eec8	41	FUNC	<unknown>	DEFAULT	2
clock_getres.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x408730	41	FUNC	<unknown>	DEFAULT	2
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
completed.2761	.symtab	0x519ea0	1	OBJECT	<unknown>	DEFAULT	10
con	.symtab	0x407a8d	620	FUNC	<unknown>	DEFAULT	2
connect	.symtab	0x40cc80	43	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
contains_fail	.symtab	0x404618	28	FUNC	<unknown>	DEFAULT	2
contains_response	.symtab	0x404634	59	FUNC	<unknown>	DEFAULT	2
contains_string	.symtab	0x404574	136	FUNC	<unknown>	DEFAULT	2
contains_success	.symtab	0x4045fc	28	FUNC	<unknown>	DEFAULT	2
creat	.symtab	0x40f0ce	14	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum	.symtab	0x4001cb	128	FUNC	<unknown>	DEFAULT	2
data_start	.symtab	0x518590	0	NOTYPE	<unknown>	DEFAULT	9
decodea.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
disable	.symtab	0x4011df	291	FUNC	<unknown>	DEFAULT	2
disabled	.symtab	0x519f08	1	OBJECT	<unknown>	DEFAULT	10
dispass	.symtab	0x5204e0	256	OBJECT	<unknown>	DEFAULT	10
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dns	.symtab	0x40364c	602	FUNC	<unknown>	DEFAULT	2
dns_format	.symtab	0x402ede	212	FUNC	<unknown>	DEFAULT	2
dns_hdr_create	.symtab	0x402fb2	106	FUNC	<unknown>	DEFAULT	2
dns_send	.symtab	0x40301c	1095	FUNC	<unknown>	DEFAULT	2
dnsflood	.symtab	0x403463	489	FUNC	<unknown>	DEFAULT	2
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
download	.symtab	0x400adf	1134	FUNC	<unknown>	DEFAULT	2
dup2	.symtab	0x40eef4	44	FUNC	<unknown>	DEFAULT	2
dup2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
enable	.symtab	0x401302	222	FUNC	<unknown>	DEFAULT	2
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
endservent	.symtab	0x410712	90	FUNC	<unknown>	DEFAULT	2
environ	.symtab	0x5203f8	8	OBJECT	<unknown>	DEFAULT	10
errno	.symtab	0x52041c	4	OBJECT	<unknown>	DEFAULT	10
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execfile	.symtab	0x520620	256	OBJECT	<unknown>	DEFAULT	10
execl	.symtab	0x40e654	287	FUNC	<unknown>	DEFAULT	2
execl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execve	.symtab	0x40ef20	38	FUNC	<unknown>	DEFAULT	2
execve.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x40e5f8	92	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x4183c0	208	OBJECT	<unknown>	DEFAULT	4
fails	.symtab	0x5196c0	72	OBJECT	<unknown>	DEFAULT	9
fastflux	.symtab	0x406c0c	565	FUNC	<unknown>	DEFAULT	2
fclose	.symtab	0x408ac0	259	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x4086a4	100	FUNC	<unknown>	DEFAULT	2
fcntl64	.symtab	0x4086a4	100	FUNC	<unknown>	DEFAULT	2
fdopen	.symtab	0x40f2e0	54	FUNC	<unknown>	DEFAULT	2
fdopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
feof	.symtab	0x40a3d8	83	FUNC	<unknown>	DEFAULT	2
feof.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fflush_unlocked	.symtab	0x40a66c	329	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x40fcd0	222	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x40a42c	109	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x40a7b8	116	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
filter	.symtab	0x40059a	162	FUNC	<unknown>	DEFAULT	2
flooders	.symtab	0x519800	352	OBJECT	<unknown>	DEFAULT	9
fmt	.symtab	0x4183a0	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x408bc4	10	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0x40875c	38	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fprintf	.symtab	0x408c94	142	FUNC	<unknown>	DEFAULT	2
fprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputc	.symtab	0x40a49c	146	FUNC	<unknown>	DEFAULT	2
fputc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputc_unlocked	.symtab	0x40a82c	192	FUNC	<unknown>	DEFAULT	2
fputc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs	.symtab	0x40a530	97	FUNC	<unknown>	DEFAULT	2
fputs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs_unlocked	.symtab	0x40a8ec	56	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x400150	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x40dc43	452	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
freeaddrinfo	.symtab	0x40bc59	22	FUNC	<unknown>	DEFAULT	2
fseek	.symtab	0x411dd4	5	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x411dd4	5	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x411e38	218	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fwrite_unlocked	.symtab	0x40a924	134	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gaih	.symtab	0x417780	48	OBJECT	<unknown>	DEFAULT	4
gaih_inet	.symtab	0x40b1be	2715	FUNC	<unknown>	DEFAULT	2
gaih_inet_serv	.symtab	0x40b110	174	FUNC	<unknown>	DEFAULT	2
gaih_inet_typeproto	.symtab	0x4177c0	35	OBJECT	<unknown>	DEFAULT	4
get	.symtab	0x400f4d	255	FUNC	<unknown>	DEFAULT	2
getBuild	.symtab	0x4001c0	11	FUNC	<unknown>	DEFAULT	2
getDatIP	.symtab	0x404032	1060	FUNC	<unknown>	DEFAULT	2
getHost	.symtab	0x402088	65	FUNC	<unknown>	DEFAULT	2
getPublicIP	.symtab	0x406b3a	115	FUNC	<unknown>	DEFAULT	2
get_hosts_byaddr_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
get_telstate_host	.symtab	0x4047fb	32	FUNC	<unknown>	DEFAULT	2
getaddrinfo	.symtab	0x40bc6f	697	FUNC	<unknown>	DEFAULT	2
getaddrinfo.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getc_unlocked	.symtab	0x40fcd0	222	FUNC	<unknown>	DEFAULT	2
getcwd	.symtab	0x408784	203	FUNC	<unknown>	DEFAULT	2
getcwd.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdtablesize	.symtab	0x408850	35	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x40ef48	38	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x40ef70	38	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x40ef98	38	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyaddr_r	.symtab	0x40c878	944	FUNC	<unknown>	DEFAULT	2
gethostbyaddr_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2_r	.symtab	0x40c538	829	FUNC	<unknown>	DEFAULT	2
gethostbyname2_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0x4118ac	897	FUNC	<unknown>	DEFAULT	2
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getmyip	.symtab	0x406bad	95	FUNC	<unknown>	DEFAULT	2
getpagesize	.symtab	0x408874	19	FUNC	<unknown>	DEFAULT	2
getpagesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x408888	38	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getppid	.symtab	0x4088b0	38	FUNC	<unknown>	DEFAULT	2
getppid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x4088d8	40	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit64	.symtab	0x4088d8	40	FUNC	<unknown>	DEFAULT	2
getservbyname	.symtab	0x4109c5	65	FUNC	<unknown>	DEFAULT	2
getservbyname_r	.symtab	0x4108dc	233	FUNC	<unknown>	DEFAULT	2
getservbyport	.symtab	0x41089b	65	FUNC	<unknown>	DEFAULT	2
getservbyport_r	.symtab	0x4107df	188	FUNC	<unknown>	DEFAULT	2
getservent	.symtab	0x4106e4	46	FUNC	<unknown>	DEFAULT	2
getservent_r	.symtab	0x4104ff	485	FUNC	<unknown>	DEFAULT	2
getservice.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x40ccac	50	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x40efc0	38	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
h_errno	.symtab	0x520420	4	OBJECT	<unknown>	DEFAULT	10
head	.symtab	0x521740	8	OBJECT	<unknown>	DEFAULT	10
help	.symtab	0x4064d7	1011	FUNC	<unknown>	DEFAULT	2
histClear	.symtab	0x406b02	56	FUNC	<unknown>	DEFAULT	2
hold	.symtab	0x402e16	200	FUNC	<unknown>	DEFAULT	2
host2ip	.symtab	0x4013e0	140	FUNC	<unknown>	DEFAULT	2
htonl	.symtab	0x40b0fc	5	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0x40b0f4	8	FUNC	<unknown>	DEFAULT	2
i.5807	.symtab	0x51a340	4	OBJECT	<unknown>	DEFAULT	10
i.5849	.symtab	0x5197e4	4	OBJECT	<unknown>	DEFAULT	9
ident	.symtab	0x5205e8	8	OBJECT	<unknown>	DEFAULT	10
identd	.symtab	0x4006ed	626	FUNC	<unknown>	DEFAULT	2
if_freenameindex	.symtab	0x410c9a	48	FUNC	<unknown>	DEFAULT	2
if_index.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
if_indextoname	.symtab	0x410a08	117	FUNC	<unknown>	DEFAULT	2
if_nameindex	.symtab	0x410af0	426	FUNC	<unknown>	DEFAULT	2
if_nametoindex	.symtab	0x410a7d	115	FUNC	<unknown>	DEFAULT	2
in6_addr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
in6addr_any	.symtab	0x417830	16	OBJECT	<unknown>	DEFAULT	4
in6addr_loopback	.symtab	0x417840	16	OBJECT	<unknown>	DEFAULT	4
in_cksum	.symtab	0x4009b3	139	FUNC	<unknown>	DEFAULT	2
index	.symtab	0x40fe10	417	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x40c51c	28	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x410ccc	137	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa	.symtab	0x40c511	10	FUNC	<unknown>	DEFAULT	2
inet_ntoa.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa_r	.symtab	0x40c4c4	77	FUNC	<unknown>	DEFAULT	2
inet_ntop	.symtab	0x40c2b4	527	FUNC	<unknown>	DEFAULT	2
inet_ntop4	.symtab	0x40c19c	280	FUNC	<unknown>	DEFAULT	2
inet_pton	.symtab	0x40bfaf	493	FUNC	<unknown>	DEFAULT	2
inet_pton4	.symtab	0x40bf28	135	FUNC	<unknown>	DEFAULT	2
infected	.symtab	0x5197d0	16	OBJECT	<unknown>	DEFAULT	9
init_rand	.symtab	0x40146c	125	FUNC	<unknown>	DEFAULT	2
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initstate	.symtab	0x40dfee	110	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x40e24f	185	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x408900	104	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isatty	.symtab	0x40b068	25	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ismaster	.symtab	0x406a72	144	FUNC	<unknown>	DEFAULT	2
junk	.symtab	0x4028cf	200	FUNC	<unknown>	DEFAULT	2
key	.symtab	0x521750	8	OBJECT	<unknown>	DEFAULT	10
kill	.symtab	0x408968	44	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
killall	.symtab	0x4068ca	245	FUNC	<unknown>	DEFAULT	2
killd	.symtab	0x4069bf	122	FUNC	<unknown>	DEFAULT	2
knownBots	.symtab	0x518600	1552	OBJECT	<unknown>	DEFAULT	9
legit	.symtab	0x5197c0	16	OBJECT	<unknown>	DEFAULT	9
lengthd.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lengthq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/memcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/mempcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/memset.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/strchr.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/strcmp.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/strcpy.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/strlen.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/strpbrk.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/string/x86_64/strspn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/x86_64/crt1.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/x86_64/crti.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/x86_64/crtn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/x86_64/vfork.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
limiter	.symtab	0x5205f0	4	OBJECT	<unknown>	DEFAULT	10
listFork	.symtab	0x401c55	201	FUNC	<unknown>	DEFAULT	2
listen	.symtab	0x40cce0	44	FUNC	<unknown>	DEFAULT	2
listen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek	.symtab	0x412900	45	FUNC	<unknown>	DEFAULT	2
lseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x4128f8	5	FUNC	<unknown>	DEFAULT	2
main	.symtab	0x407dd4	2253	FUNC	<unknown>	DEFAULT	2
makeFukdString	.symtab	0x407cf9	141	FUNC	<unknown>	DEFAULT	2
makeRandomShit	.symtab	0x4018ab	142	FUNC	<unknown>	DEFAULT	2
malloc	.symtab	0x40ce4c	2149	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
malloc_trim	.symtab	0x40de07	28	FUNC	<unknown>	DEFAULT	2
masters	.symtab	0x5185d0	24	OBJECT	<unknown>	DEFAULT	9
memchr	.symtab	0x40ffb4	240	FUNC	<unknown>	DEFAULT	2
memchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memcpy	.symtab	0x40a9b0	102	FUNC	<unknown>	DEFAULT	2
memmove	.symtab	0x4100a4	734	FUNC	<unknown>	DEFAULT	2
memmove.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mempcpy	.symtab	0x40fdb0	90	FUNC	<unknown>	DEFAULT	2
memrchr	.symtab	0x410384	237	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x40aa20	210	FUNC	<unknown>	DEFAULT	2
mfork	.symtab	0x40049d	253	FUNC	<unknown>	DEFAULT	2
mmap	.symtab	0x40ee54	48	FUNC	<unknown>	DEFAULT	2
mmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
move	.symtab	0x406470	103	FUNC	<unknown>	DEFAULT	2
mremap	.symtab	0x40efe8	42	FUNC	<unknown>	DEFAULT	2
mremap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
msgs	.symtab	0x519960	128	OBJECT	<unknown>	DEFAULT	9
munmap	.symtab	0x40f014	38	FUNC	<unknown>	DEFAULT	2
munmap.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mygethostbyname	.symtab	0x400a3e	161	FUNC	<unknown>	DEFAULT	2
mylock	.symtab	0x51e360	40	OBJECT	<unknown>	DEFAULT	10
mylock	.symtab	0x519c80	40	OBJECT	<unknown>	DEFAULT	9
mylock	.symtab	0x519cc0	40	OBJECT	<unknown>	DEFAULT	9
mylock	.symtab	0x519e20	40	OBJECT	<unknown>	DEFAULT	9
mylock	.symtab	0x5204a0	40	OBJECT	<unknown>	DEFAULT	10
nanosleep	.symtab	0x40f03c	38	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
negotiate	.symtab	0x404456	286	FUNC	<unknown>	DEFAULT	2
next_start.1440	.symtab	0x5203c0	8	OBJECT	<unknown>	DEFAULT	10
nick	.symtab	0x5205f8	8	OBJECT	<unknown>	DEFAULT	10
nickc	.symtab	0x40107a	174	FUNC	<unknown>	DEFAULT	2
ntohl	.symtab	0x40b109	5	FUNC	<unknown>	DEFAULT	2
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0x40b101	8	FUNC	<unknown>	DEFAULT	2
ntop.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
nummasters	.symtab	0x5185c0	4	OBJECT	<unknown>	DEFAULT	9
numpids	.symtab	0x519f20	8	OBJECT	<unknown>	DEFAULT	10
numservers	.symtab	0x5185a0	4	OBJECT	<unknown>	DEFAULT	9
object.2814	.symtab	0x519ec0	48	OBJECT	<unknown>	DEFAULT	10
open	.symtab	0x40f064	106	FUNC	<unknown>	DEFAULT	2
open.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opennameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opensock.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
p.2759	.symtab	0x518588	0	OBJECT	<unknown>	DEFAULT	9
passwords	.symtab	0x5191e0	1184	OBJECT	<unknown>	DEFAULT	9
pclose	.symtab	0x408fa8	190	FUNC	<unknown>	DEFAULT	2
perror	.symtab	0x408bd0	45	FUNC	<unknown>	DEFAULT	2
perror.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pid	.symtab	0x5205e0	4	OBJECT	<unknown>	DEFAULT	10
pids	.symtab	0x521768	8	OBJECT	<unknown>	DEFAULT	10
pipe	.symtab	0x40f0dc	38	FUNC	<unknown>	DEFAULT	2
pipe.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
poll	.symtab	0x408994	41	FUNC	<unknown>	DEFAULT	2
poll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
popen	.symtab	0x409066	485	FUNC	<unknown>	DEFAULT	2
popen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
popen_list	.symtab	0x51e388	8	OBJECT	<unknown>	DEFAULT	10
poww	.symtab	0x40095f	84	FUNC	<unknown>	DEFAULT	2
pps	.symtab	0x520720	4	OBJECT	<unknown>	DEFAULT	10
prefix.4494	.symtab	0x416b55	12	OBJECT	<unknown>	DEFAULT	4
print	.symtab	0x403b10	1085	FUNC	<unknown>	DEFAULT	2
printchar	.symtab	0x4038a6	75	FUNC	<unknown>	DEFAULT	2
printi	.symtab	0x4039d0	320	FUNC	<unknown>	DEFAULT	2
prints	.symtab	0x4038f1	223	FUNC	<unknown>	DEFAULT	2
putc	.symtab	0x40a49c	146	FUNC	<unknown>	DEFAULT	2
putc_unlocked	.symtab	0x40a82c	192	FUNC	<unknown>	DEFAULT	2
puts	.symtab	0x408c00	130	FUNC	<unknown>	DEFAULT	2
puts.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
qual_chars.4498	.symtab	0x416b70	20	OBJECT	<unknown>	DEFAULT	4
raise	.symtab	0x411c60	18	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x40df38	11	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_cmwc	.symtab	0x4014e9	179	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x40df44	72	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x417880	40	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x40e14c	90	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randstring	.symtab	0x40063c	177	FUNC	<unknown>	DEFAULT	2
randtbl	.symtab	0x519d40	128	OBJECT	<unknown>	DEFAULT	9
rawmemchr	.symtab	0x4121b8	190	FUNC	<unknown>	DEFAULT	2
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0x412930	39	FUNC	<unknown>	DEFAULT	2
read.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read_etc_hosts_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read_until_response	.symtab	0x404774	135	FUNC	<unknown>	DEFAULT	2
read_with_timeout	.symtab	0x40466f	261	FUNC	<unknown>	DEFAULT	2
realloc	.symtab	0x40d6b4	857	FUNC	<unknown>	DEFAULT	2
realloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
realrand	.symtab	0x401128	78	FUNC	<unknown>	DEFAULT	2
recv	.symtab	0x40cd0c	11	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
recvfrom	.symtab	0x40cd18	45	FUNC	<unknown>	DEFAULT	2
recvfrom.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rekdevice	.symtab	0x5185e8	8	OBJECT	<unknown>	DEFAULT	9
reset_telstate	.symtab	0x40486e	36	FUNC	<unknown>	DEFAULT	2
rewind	.symtab	0x411ddc	92	FUNC	<unknown>	DEFAULT	2
rewind.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rnd	.symtab	0x521758	4	OBJECT	<unknown>	DEFAULT	10
rndnick	.symtab	0x401176	105	FUNC	<unknown>	DEFAULT	2
rseed	.symtab	0x520740	4096	OBJECT	<unknown>	DEFAULT	10
rsi	.symtab	0x520608	4	OBJECT	<unknown>	DEFAULT	10
sbrk	.symtab	0x40f104	74	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
scanPid	.symtab	0x519f00	4	OBJECT	<unknown>	DEFAULT	10
sclose	.symtab	0x404892	46	FUNC	<unknown>	DEFAULT	2
select	.symtab	0x4089c0	44	FUNC	<unknown>	DEFAULT	2
select.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send	.symtab	0x40cd48	11	FUNC	<unknown>	DEFAULT	2
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sendHOLD	.symtab	0x402997	1151	FUNC	<unknown>	DEFAULT	2
sendHTTP	.symtab	0x402173	523	FUNC	<unknown>	DEFAULT	2
sendJUNK	.symtab	0x402492	1085	FUNC	<unknown>	DEFAULT	2
sendSTD	.symtab	0x401d1e	874	FUNC	<unknown>	DEFAULT	2
sendto	.symtab	0x40cd54	48	FUNC	<unknown>	DEFAULT	2
sendto.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
serv	.symtab	0x520460	32	OBJECT	<unknown>	DEFAULT	10
serv_stayopen	.symtab	0x520480	4	OBJECT	<unknown>	DEFAULT	10
servbuf	.symtab	0x520440	8	OBJECT	<unknown>	DEFAULT	10
server	.symtab	0x520728	8	OBJECT	<unknown>	DEFAULT	10
servers	.symtab	0x5185b0	16	OBJECT	<unknown>	DEFAULT	9
servf	.symtab	0x520448	8	OBJECT	<unknown>	DEFAULT	10
setservent	.symtab	0x41076c	115	FUNC	<unknown>	DEFAULT	2
setsid	.symtab	0x4089ec	38	FUNC	<unknown>	DEFAULT	2
setsid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsockopt	.symtab	0x40cd84	53	FUNC	<unknown>	DEFAULT	2
setsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0x40df8c	98	FUNC	<unknown>	DEFAULT	2
setstate_r	.symtab	0x40e0a4	168	FUNC	<unknown>	DEFAULT	2
sigaction	.symtab	0x40ed5d	247	FUNC	<unknown>	DEFAULT	2
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
signal	.symtab	0x411c74	168	FUNC	<unknown>	DEFAULT	2
signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask	.symtab	0x40f150	85	FUNC	<unknown>	DEFAULT	2
sigprocmask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigsetops.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sleep	.symtab	0x40e774	415	FUNC	<unknown>	DEFAULT	2
sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sleeptime	.symtab	0x5197e8	4	OBJECT	<unknown>	DEFAULT	9
sock	.symtab	0x520600	4	OBJECT	<unknown>	DEFAULT	10
socket	.symtab	0x40cdbc	47	FUNC	<unknown>	DEFAULT	2
socket.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket_connect	.symtab	0x4020c9	170	FUNC	<unknown>	DEFAULT	2
spec_and_mask.4497	.symtab	0x416b90	16	OBJECT	<unknown>	DEFAULT	4
spec_base.4493	.symtab	0x416b61	7	OBJECT	<unknown>	DEFAULT	4
spec_chars.4494	.symtab	0x416bc0	21	OBJECT	<unknown>	DEFAULT	4
spec_flags.4493	.symtab	0x416bd5	8	OBJECT	<unknown>	DEFAULT	4
spec_or_mask.4496	.symtab	0x416ba0	16	OBJECT	<unknown>	DEFAULT	4
spec_ranges.4495	.symtab	0x416bb0	9	OBJECT	<unknown>	DEFAULT	4
spoofs	.symtab	0x519f10	8	OBJECT	<unknown>	DEFAULT	10
spoofsm	.symtab	0x519f18	8	OBJECT	<unknown>	DEFAULT	10
sprintf	.symtab	0x408db4	149	FUNC	<unknown>	DEFAULT	2
sprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
srand	.symtab	0x40e05c	72	FUNC	<unknown>	DEFAULT	2
srandom	.symtab	0x40e05c	72	FUNC	<unknown>	DEFAULT	2
srandom_r	.symtab	0x40e1a6	169	FUNC	<unknown>	DEFAULT	2
static_id	.symtab	0x519e48	2	OBJECT	<unknown>	DEFAULT	9
static_ns	.symtab	0x5204c8	4	OBJECT	<unknown>	DEFAULT	10
stderr	.symtab	0x519a10	8	OBJECT	<unknown>	DEFAULT	9
stdin	.symtab	0x519a00	8	OBJECT	<unknown>	DEFAULT	9
stdout	.symtab	0x519a08	8	OBJECT	<unknown>	DEFAULT	9
strcasecmp	.symtab	0x40afac	48	FUNC	<unknown>	DEFAULT	2
strcasecmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcasestr	.symtab	0x40afdc	70	FUNC	<unknown>	DEFAULT	2
strcasestr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchr	.symtab	0x40fe10	417	FUNC	<unknown>	DEFAULT	2
strcmp	.symtab	0x41207c	33	FUNC	<unknown>	DEFAULT	2
strcoll	.symtab	0x41207c	33	FUNC	<unknown>	DEFAULT	2
strcpy	.symtab	0x40ab00	213	FUNC	<unknown>	DEFAULT	2
strdup	.symtab	0x40b024	54	FUNC	<unknown>	DEFAULT	2
strdup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strerror_r	.symtab	0x40aed8	194	FUNC	<unknown>	DEFAULT	2
strlen	.symtab	0x40abe0	225	FUNC	<unknown>	DEFAULT	2
strncat	.symtab	0x412278	119	FUNC	<unknown>	DEFAULT	2
strncat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncmp	.symtab	0x40acc4	176	FUNC	<unknown>	DEFAULT	2
strncmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncpy	.symtab	0x40ad74	131	FUNC	<unknown>	DEFAULT	2
strncpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strnlen	.symtab	0x40adf8	206	FUNC	<unknown>	DEFAULT	2
strnlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strpbrk	.symtab	0x4120a0	140	FUNC	<unknown>	DEFAULT	2
strspn	.symtab	0x412130	135	FUNC	<unknown>	DEFAULT	2
strtoimax	.symtab	0x40e478	10	FUNC	<unknown>	DEFAULT	2
strtok	.symtab	0x40b05c	10	FUNC	<unknown>	DEFAULT	2
strtok.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok_r	.symtab	0x410474	94	FUNC	<unknown>	DEFAULT	2
strtok_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtol	.symtab	0x40e478	10	FUNC	<unknown>	DEFAULT	2
strtol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtoll	.symtab	0x40e478	10	FUNC	<unknown>	DEFAULT	2
strtoul	.symtab	0x40e484	7	FUNC	<unknown>	DEFAULT	2
strtoul.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtoull	.symtab	0x40e484	7	FUNC	<unknown>	DEFAULT	2
strtoumax	.symtab	0x40e484	7	FUNC	<unknown>	DEFAULT	2
strwildmatch	.symtab	0x40024b	308	FUNC	<unknown>	DEFAULT	2
successes	.symtab	0x519720	64	OBJECT	<unknown>	DEFAULT	9
sysconf	.symtab	0x40e914	351	FUNC	<unknown>	DEFAULT	2
sysconf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
system	.symtab	0x40e308	335	FUNC	<unknown>	DEFAULT	2
system.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
szprintf	.symtab	0x403f4d	229	FUNC	<unknown>	DEFAULT	2
tcgetattr	.symtab	0x40b084	110	FUNC	<unknown>	DEFAULT	2
tcgetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tehport	.symtab	0x521748	4	OBJECT	<unknown>	DEFAULT	10
textBuffer.5285	.symtab	0x519f40	1024	OBJECT	<unknown>	DEFAULT	10
thanks	.symtab	0x5197f0	8	OBJECT	<unknown>	DEFAULT	9
time	.symtab	0x408a14	39	FUNC	<unknown>	DEFAULT	2
time.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tolower	.symtab	0x40f1d8	30	FUNC	<unknown>	DEFAULT	2
tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
touchMyself	.symtab	0x407d86	78	FUNC	<unknown>	DEFAULT	2
toupper	.symtab	0x408a98	30	FUNC	<unknown>	DEFAULT	2
toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
type_codes	.symtab	0x416be0	24	OBJECT	<unknown>	DEFAULT	4
type_sizes	.symtab	0x416bf8	12	OBJECT	<unknown>	DEFAULT	4
umask	.symtab	0x408a3c	40	FUNC	<unknown>	DEFAULT	2
umask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
unknown	.symtab	0x401939	796	FUNC	<unknown>	DEFAULT	2
unknown.2050	.symtab	0x416c04	14	OBJECT	<unknown>	DEFAULT	4
unsafe_state	.symtab	0x519d00	48	OBJECT	<unknown>	DEFAULT	9
user	.symtab	0x520610	8	OBJECT	<unknown>	DEFAULT	10
usernames	.symtab	0x518d40	1184	OBJECT	<unknown>	DEFAULT	9
usleep	.symtab	0x40ea74	52	FUNC	<unknown>	DEFAULT	2
usleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
vasprintf	.symtab	0x408e4c	146	FUNC	<unknown>	DEFAULT	2
vasprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
version	.symtab	0x40104c	46	FUNC	<unknown>	DEFAULT	2
vfork	.symtab	0x40ee84	21	FUNC	<unknown>	DEFAULT	2
vfprintf	.symtab	0x4095a0	143	FUNC	<unknown>	DEFAULT	2
vfprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
vsnprintf	.symtab	0x408ee0	199	FUNC	<unknown>	DEFAULT	2
vsnprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
vsprintf	.symtab	0x408c84	15	FUNC	<unknown>	DEFAULT	2
vsprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wait4	.symtab	0x40f1a8	47	FUNC	<unknown>	DEFAULT	2
wait4.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
waitpid	.symtab	0x408a64	7	FUNC	<unknown>	DEFAULT	2
waitpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcrtomb	.symtab	0x40f200	68	FUNC	<unknown>	DEFAULT	2
wcrtomb.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsnrtombs	.symtab	0x40f254	140	FUNC	<unknown>	DEFAULT	2
wcsnrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsrtombs	.symtab	0x40f244	15	FUNC	<unknown>	DEFAULT	2
wcsrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
write	.symtab	0x408a6c	42	FUNC	<unknown>	DEFAULT	2
write.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
xdigits.3747	.symtab	0x417810	17	OBJECT	<unknown>	DEFAULT	4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 23, 2024 11:07:15.107566118 CET	56980	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:07:15.227171898 CET	6780	56980	95.234.158.87	192.168.2.14
Nov 23, 2024 11:07:15.227248907 CET	56980	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:07:16.111596107 CET	56980	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:07:16.231467962 CET	6780	56980	95.234.158.87	192.168.2.14
Nov 23, 2024 11:07:16.519535065 CET	6780	56980	95.234.158.87	192.168.2.14
Nov 23, 2024 11:07:16.519608974 CET	56980	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:07:16.639492989 CET	6780	56980	95.234.158.87	192.168.2.14
Nov 23, 2024 11:07:16.639537096 CET	6780	56980	95.234.158.87	192.168.2.14
Nov 23, 2024 11:07:16.639622927 CET	56980	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:07:16.639733076 CET	56980	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:07:16.760133982 CET	6780	56980	95.234.158.87	192.168.2.14
Nov 23, 2024 11:07:21.646709919 CET	56982	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:07:21.766742945 CET	6780	56982	95.234.158.87	192.168.2.14
Nov 23, 2024 11:07:21.767019987 CET	56982	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:07:22.655216932 CET	56982	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:07:22.775512934 CET	6780	56982	95.234.158.87	192.168.2.14
Nov 23, 2024 11:07:22.967658043 CET	6780	56982	95.234.158.87	192.168.2.14
Nov 23, 2024 11:07:22.967722893 CET	56982	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:07:23.082310915 CET	6780	56982	95.234.158.87	192.168.2.14
Nov 23, 2024 11:07:23.082349062 CET	6780	56982	95.234.158.87	192.168.2.14
Nov 23, 2024 11:07:23.082386971 CET	56982	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:07:23.082467079 CET	56982	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:07:23.202080965 CET	6780	56982	95.234.158.87	192.168.2.14
Nov 23, 2024 11:07:28.084167957 CET	56984	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:07:28.203872919 CET	6780	56984	95.234.158.87	192.168.2.14
Nov 23, 2024 11:07:28.203937054 CET	56984	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:07:29.088733912 CET	56984	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:07:29.209450006 CET	6780	56984	95.234.158.87	192.168.2.14
Nov 23, 2024 11:07:29.421188116 CET	6780	56984	95.234.158.87	192.168.2.14
Nov 23, 2024 11:07:29.421205997 CET	6780	56984	95.234.158.87	192.168.2.14
Nov 23, 2024 11:07:29.421319008 CET	56984	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:07:29.421482086 CET	56984	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:07:29.540956974 CET	6780	56984	95.234.158.87	192.168.2.14
Nov 23, 2024 11:07:34.423819065 CET	56986	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:07:34.543570042 CET	6780	56986	95.234.158.87	192.168.2.14
Nov 23, 2024 11:07:34.543685913 CET	56986	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:07:35.429016113 CET	56986	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:07:35.549285889 CET	6780	56986	95.234.158.87	192.168.2.14
Nov 23, 2024 11:07:35.712264061 CET	6780	56986	95.234.158.87	192.168.2.14
Nov 23, 2024 11:07:35.712330103 CET	56986	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:07:35.712333918 CET	6780	56986	95.234.158.87	192.168.2.14
Nov 23, 2024 11:07:35.712383986 CET	56986	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:07:35.712383986 CET	56986	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:07:35.831968069 CET	6780	56986	95.234.158.87	192.168.2.14
Nov 23, 2024 11:07:40.714293957 CET	56988	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:07:40.833940983 CET	6780	56988	95.234.158.87	192.168.2.14
Nov 23, 2024 11:07:40.834079981 CET	56988	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:07:41.720904112 CET	56988	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:07:41.841209888 CET	6780	56988	95.234.158.87	192.168.2.14
Nov 23, 2024 11:07:42.031568050 CET	6780	56988	95.234.158.87	192.168.2.14
Nov 23, 2024 11:07:42.031625986 CET	56988	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:07:42.031667948 CET	6780	56988	95.234.158.87	192.168.2.14
Nov 23, 2024 11:07:42.031708002 CET	56988	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:07:42.031730890 CET	56988	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:07:42.151377916 CET	6780	56988	95.234.158.87	192.168.2.14
Nov 23, 2024 11:07:47.033587933 CET	56990	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:07:47.157166004 CET	6780	56990	95.234.158.87	192.168.2.14
Nov 23, 2024 11:07:47.157275915 CET	56990	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:07:48.037327051 CET	56990	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:07:48.157028913 CET	6780	56990	95.234.158.87	192.168.2.14
Nov 23, 2024 11:07:48.337634087 CET	6780	56990	95.234.158.87	192.168.2.14
Nov 23, 2024 11:07:48.337670088 CET	6780	56990	95.234.158.87	192.168.2.14
Nov 23, 2024 11:07:48.337716103 CET	56990	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:07:48.337750912 CET	56990	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:07:48.457438946 CET	6780	56990	95.234.158.87	192.168.2.14
Nov 23, 2024 11:07:53.339145899 CET	56992	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:07:53.458942890 CET	6780	56992	95.234.158.87	192.168.2.14
Nov 23, 2024 11:07:53.459038019 CET	56992	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:07:54.343559980 CET	56992	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:07:54.463184118 CET	6780	56992	95.234.158.87	192.168.2.14
Nov 23, 2024 11:07:54.572356939 CET	6780	56992	95.234.158.87	192.168.2.14
Nov 23, 2024 11:07:54.572412014 CET	56992	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:07:54.572451115 CET	56992	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:07:54.572540045 CET	6780	56992	95.234.158.87	192.168.2.14
Nov 23, 2024 11:07:54.572576046 CET	56992	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:07:54.694231033 CET	6780	56992	95.234.158.87	192.168.2.14
Nov 23, 2024 11:07:59.573935986 CET	56994	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:07:59.694621086 CET	6780	56994	95.234.158.87	192.168.2.14
Nov 23, 2024 11:07:59.694840908 CET	56994	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:08:00.578236103 CET	56994	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:08:00.698209047 CET	6780	56994	95.234.158.87	192.168.2.14
Nov 23, 2024 11:08:00.845089912 CET	6780	56994	95.234.158.87	192.168.2.14
Nov 23, 2024 11:08:00.845139980 CET	56994	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:08:00.845149994 CET	6780	56994	95.234.158.87	192.168.2.14
Nov 23, 2024 11:08:00.845170021 CET	56994	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:08:00.845191956 CET	56994	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:08:00.967052937 CET	6780	56994	95.234.158.87	192.168.2.14
Nov 23, 2024 11:08:05.846744061 CET	56996	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:08:05.967439890 CET	6780	56996	95.234.158.87	192.168.2.14
Nov 23, 2024 11:08:05.967530966 CET	56996	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:08:06.851147890 CET	56996	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:08:06.971004963 CET	6780	56996	95.234.158.87	192.168.2.14
Nov 23, 2024 11:08:07.154352903 CET	6780	56996	95.234.158.87	192.168.2.14
Nov 23, 2024 11:08:07.154537916 CET	6780	56996	95.234.158.87	192.168.2.14
Nov 23, 2024 11:08:07.154592991 CET	56996	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:08:07.154593945 CET	56996	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:08:07.154593945 CET	56996	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:08:07.275269985 CET	6780	56996	95.234.158.87	192.168.2.14
Nov 23, 2024 11:08:12.155864000 CET	56998	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:08:12.275588036 CET	6780	56998	95.234.158.87	192.168.2.14
Nov 23, 2024 11:08:12.275671959 CET	56998	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:08:13.159553051 CET	56998	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:08:13.279258013 CET	6780	56998	95.234.158.87	192.168.2.14
Nov 23, 2024 11:08:13.476237059 CET	6780	56998	95.234.158.87	192.168.2.14
Nov 23, 2024 11:08:13.476358891 CET	56998	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:08:13.476358891 CET	56998	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:08:13.476383924 CET	6780	56998	95.234.158.87	192.168.2.14
Nov 23, 2024 11:08:13.476454020 CET	56998	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:08:13.595918894 CET	6780	56998	95.234.158.87	192.168.2.14
Nov 23, 2024 11:08:18.477622986 CET	57000	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:08:18.597323895 CET	6780	57000	95.234.158.87	192.168.2.14
Nov 23, 2024 11:08:18.597392082 CET	57000	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:08:19.481436014 CET	57000	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:08:19.601181984 CET	6780	57000	95.234.158.87	192.168.2.14
Nov 23, 2024 11:08:19.797907114 CET	6780	57000	95.234.158.87	192.168.2.14
Nov 23, 2024 11:08:19.797993898 CET	57000	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:08:19.798013926 CET	57000	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:08:19.798032999 CET	6780	57000	95.234.158.87	192.168.2.14
Nov 23, 2024 11:08:19.798088074 CET	57000	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:08:19.917574883 CET	6780	57000	95.234.158.87	192.168.2.14
Nov 23, 2024 11:08:24.812361956 CET	57002	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:08:24.933171988 CET	6780	57002	95.234.158.87	192.168.2.14
Nov 23, 2024 11:08:24.933217049 CET	57002	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:08:25.816382885 CET	57002	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:08:25.936028957 CET	6780	57002	95.234.158.87	192.168.2.14
Nov 23, 2024 11:08:26.060280085 CET	6780	57002	95.234.158.87	192.168.2.14
Nov 23, 2024 11:08:26.060396910 CET	57002	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:08:26.060487032 CET	6780	57002	95.234.158.87	192.168.2.14
Nov 23, 2024 11:08:26.060511112 CET	57002	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:08:26.060576916 CET	57002	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:08:26.180068970 CET	6780	57002	95.234.158.87	192.168.2.14
Nov 23, 2024 11:08:31.062755108 CET	57004	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:08:31.185278893 CET	6780	57004	95.234.158.87	192.168.2.14
Nov 23, 2024 11:08:31.185396910 CET	57004	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:08:32.069988966 CET	57004	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:08:32.189564943 CET	6780	57004	95.234.158.87	192.168.2.14
Nov 23, 2024 11:08:32.333528996 CET	6780	57004	95.234.158.87	192.168.2.14
Nov 23, 2024 11:08:32.333678007 CET	57004	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:08:32.333678007 CET	57004	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:08:32.333719015 CET	6780	57004	95.234.158.87	192.168.2.14
Nov 23, 2024 11:08:32.333775997 CET	57004	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:08:32.453279018 CET	6780	57004	95.234.158.87	192.168.2.14
Nov 23, 2024 11:08:37.335511923 CET	57006	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:08:37.459412098 CET	6780	57006	95.234.158.87	192.168.2.14
Nov 23, 2024 11:08:37.459548950 CET	57006	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:08:38.339909077 CET	57006	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:08:38.459871054 CET	6780	57006	95.234.158.87	192.168.2.14
Nov 23, 2024 11:08:38.601480007 CET	6780	57006	95.234.158.87	192.168.2.14
Nov 23, 2024 11:08:38.601527929 CET	57006	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:08:38.601567984 CET	57006	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:08:38.601568937 CET	6780	57006	95.234.158.87	192.168.2.14
Nov 23, 2024 11:08:38.601625919 CET	57006	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:08:38.723026037 CET	6780	57006	95.234.158.87	192.168.2.14
Nov 23, 2024 11:08:43.637840986 CET	57008	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:08:43.757500887 CET	6780	57008	95.234.158.87	192.168.2.14
Nov 23, 2024 11:08:43.761416912 CET	57008	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:08:44.703775883 CET	57008	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:08:44.824718952 CET	6780	57008	95.234.158.87	192.168.2.14
Nov 23, 2024 11:08:45.024777889 CET	6780	57008	95.234.158.87	192.168.2.14
Nov 23, 2024 11:08:45.024831057 CET	57008	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:08:45.136817932 CET	6780	57008	95.234.158.87	192.168.2.14
Nov 23, 2024 11:08:45.136930943 CET	57008	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:08:45.136930943 CET	57008	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:08:45.136964083 CET	6780	57008	95.234.158.87	192.168.2.14
Nov 23, 2024 11:08:45.137017965 CET	57008	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:08:45.256583929 CET	6780	57008	95.234.158.87	192.168.2.14
Nov 23, 2024 11:08:50.138793945 CET	57010	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:08:50.259068012 CET	6780	57010	95.234.158.87	192.168.2.14
Nov 23, 2024 11:08:50.259151936 CET	57010	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:08:51.143254995 CET	57010	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:08:51.263253927 CET	6780	57010	95.234.158.87	192.168.2.14
Nov 23, 2024 11:08:51.448184013 CET	6780	57010	95.234.158.87	192.168.2.14
Nov 23, 2024 11:08:51.448386908 CET	6780	57010	95.234.158.87	192.168.2.14
Nov 23, 2024 11:08:51.448410988 CET	57010	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:08:51.448410988 CET	57010	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:08:51.448476076 CET	57010	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:08:51.567964077 CET	6780	57010	95.234.158.87	192.168.2.14
Nov 23, 2024 11:08:56.450233936 CET	57012	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:08:56.569870949 CET	6780	57012	95.234.158.87	192.168.2.14
Nov 23, 2024 11:08:56.573143005 CET	57012	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:08:57.455054998 CET	57012	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:08:57.574650049 CET	6780	57012	95.234.158.87	192.168.2.14
Nov 23, 2024 11:08:57.722769022 CET	6780	57012	95.234.158.87	192.168.2.14
Nov 23, 2024 11:08:57.722840071 CET	57012	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:08:57.722840071 CET	57012	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:08:57.722865105 CET	6780	57012	95.234.158.87	192.168.2.14
Nov 23, 2024 11:08:57.722902060 CET	57012	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:08:57.843033075 CET	6780	57012	95.234.158.87	192.168.2.14
Nov 23, 2024 11:09:02.725564003 CET	57014	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:09:02.845448017 CET	6780	57014	95.234.158.87	192.168.2.14
Nov 23, 2024 11:09:02.845561028 CET	57014	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:09:03.732950926 CET	57014	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:09:03.853409052 CET	6780	57014	95.234.158.87	192.168.2.14
Nov 23, 2024 11:09:03.968843937 CET	6780	57014	95.234.158.87	192.168.2.14
Nov 23, 2024 11:09:03.968909025 CET	6780	57014	95.234.158.87	192.168.2.14
Nov 23, 2024 11:09:03.969063997 CET	57014	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:09:03.969063997 CET	57014	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:09:04.088844061 CET	6780	57014	95.234.158.87	192.168.2.14
Nov 23, 2024 11:09:08.970854998 CET	57016	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:09:09.090595007 CET	6780	57016	95.234.158.87	192.168.2.14
Nov 23, 2024 11:09:09.090738058 CET	57016	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:09:09.975722075 CET	57016	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:09:10.095443010 CET	6780	57016	95.234.158.87	192.168.2.14
Nov 23, 2024 11:09:10.242872953 CET	6780	57016	95.234.158.87	192.168.2.14
Nov 23, 2024 11:09:10.242928982 CET	57016	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:09:10.242961884 CET	6780	57016	95.234.158.87	192.168.2.14
Nov 23, 2024 11:09:10.242994070 CET	57016	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:09:10.242994070 CET	57016	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:09:10.362556934 CET	6780	57016	95.234.158.87	192.168.2.14
Nov 23, 2024 11:09:15.245379925 CET	57018	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:09:15.368691921 CET	6780	57018	95.234.158.87	192.168.2.14
Nov 23, 2024 11:09:15.368782043 CET	57018	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:09:16.249722004 CET	57018	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:09:16.369512081 CET	6780	57018	95.234.158.87	192.168.2.14
Nov 23, 2024 11:09:16.531305075 CET	6780	57018	95.234.158.87	192.168.2.14
Nov 23, 2024 11:09:16.531457901 CET	57018	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:09:16.531457901 CET	57018	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:09:16.531461954 CET	6780	57018	95.234.158.87	192.168.2.14
Nov 23, 2024 11:09:16.531503916 CET	57018	6780	192.168.2.14	95.234.158.87
Nov 23, 2024 11:09:16.651120901 CET	6780	57018	95.234.158.87	192.168.2.14

IRC Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP	Commands
Nov 23, 2024 11:07:16.111596107 CET	56980	6780	192.168.2.14	95.234.158.87	NICK [OSX\|x86_64]iKAieWz USER iKAieWz localhost localhost :iKAieWz
Nov 23, 2024 11:07:22.655216932 CET	56982	6780	192.168.2.14	95.234.158.87	NICK [OSX\|x86_64]iKAieWz USER iKAieWz localhost localhost :iKAieWz
Nov 23, 2024 11:07:29.088733912 CET	56984	6780	192.168.2.14	95.234.158.87	NICK [OSX\|x86_64]iKAieWz USER iKAieWz localhost localhost :iKAieWz
Nov 23, 2024 11:07:35.429016113 CET	56986	6780	192.168.2.14	95.234.158.87	NICK [OSX\|x86_64]iKAieWz USER iKAieWz localhost localhost :iKAieWz
Nov 23, 2024 11:07:41.720904112 CET	56988	6780	192.168.2.14	95.234.158.87	NICK [OSX\|x86_64]iKAieWz USER iKAieWz localhost localhost :iKAieWz
Nov 23, 2024 11:07:48.037327051 CET	56990	6780	192.168.2.14	95.234.158.87	NICK [OSX\|x86_64]iKAieWz USER iKAieWz localhost localhost :iKAieWz
Nov 23, 2024 11:07:54.343559980 CET	56992	6780	192.168.2.14	95.234.158.87	NICK [OSX\|x86_64]iKAieWz USER iKAieWz localhost localhost :iKAieWz
Nov 23, 2024 11:08:00.578236103 CET	56994	6780	192.168.2.14	95.234.158.87	NICK [OSX\|x86_64]iKAieWz USER iKAieWz localhost localhost :iKAieWz
Nov 23, 2024 11:08:06.851147890 CET	56996	6780	192.168.2.14	95.234.158.87	NICK [OSX\|x86_64]iKAieWz USER iKAieWz localhost localhost :iKAieWz
Nov 23, 2024 11:08:13.159553051 CET	56998	6780	192.168.2.14	95.234.158.87	NICK [OSX\|x86_64]iKAieWz USER iKAieWz localhost localhost :iKAieWz
Nov 23, 2024 11:08:19.481436014 CET	57000	6780	192.168.2.14	95.234.158.87	NICK [OSX\|x86_64]iKAieWz USER iKAieWz localhost localhost :iKAieWz
Nov 23, 2024 11:08:25.816382885 CET	57002	6780	192.168.2.14	95.234.158.87	NICK [OSX\|x86_64]iKAieWz USER iKAieWz localhost localhost :iKAieWz
Nov 23, 2024 11:08:32.069988966 CET	57004	6780	192.168.2.14	95.234.158.87	NICK [OSX\|x86_64]iKAieWz USER iKAieWz localhost localhost :iKAieWz
Nov 23, 2024 11:08:38.339909077 CET	57006	6780	192.168.2.14	95.234.158.87	NICK [OSX\|x86_64]iKAieWz USER iKAieWz localhost localhost :iKAieWz
Nov 23, 2024 11:08:44.703775883 CET	57008	6780	192.168.2.14	95.234.158.87	NICK [OSX\|x86_64]iKAieWz USER iKAieWz localhost localhost :iKAieWz
Nov 23, 2024 11:08:51.143254995 CET	57010	6780	192.168.2.14	95.234.158.87	NICK [OSX\|x86_64]iKAieWz USER iKAieWz localhost localhost :iKAieWz
Nov 23, 2024 11:08:57.455054998 CET	57012	6780	192.168.2.14	95.234.158.87	NICK [OSX\|x86_64]iKAieWz USER iKAieWz localhost localhost :iKAieWz
Nov 23, 2024 11:09:03.732950926 CET	57014	6780	192.168.2.14	95.234.158.87	NICK [OSX\|x86_64]iKAieWz USER iKAieWz localhost localhost :iKAieWz
Nov 23, 2024 11:09:09.975722075 CET	57016	6780	192.168.2.14	95.234.158.87	NICK [OSX\|x86_64]iKAieWz USER iKAieWz localhost localhost :iKAieWz
Nov 23, 2024 11:09:16.249722004 CET	57018	6780	192.168.2.14	95.234.158.87	NICK [OSX\|x86_64]iKAieWz USER iKAieWz localhost localhost :iKAieWz

System Behavior

Analysis Process: yakuza.x86.elf PID: 5537, Parent PID: 5458

General

Start time (UTC):	10:07:14
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.x86.elf
Arguments:	/tmp/yakuza.x86.elf
File size:	142929 bytes
MD5 hash:	86ae7faf59555791f91c85614824d7fc

Chronological Activities

Analysis Process: yakuza.x86.elf PID: 5538, Parent PID: 5537

General

Start time (UTC):	10:07:14
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.x86.elf
Arguments:	-
File size:	142929 bytes
MD5 hash:	86ae7faf59555791f91c85614824d7fc

Chronological Activities

Analysis Process: yakuza.x86.elf PID: 5539, Parent PID: 5538

General

Start time (UTC):	10:07:14
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.x86.elf
Arguments:	-
File size:	142929 bytes
MD5 hash:	86ae7faf59555791f91c85614824d7fc

Chronological Activities

Analysis Process: yakuza.x86.elf PID: 5540, Parent PID: 5538

General

Start time (UTC):	10:07:14
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.x86.elf
Arguments:	-
File size:	142929 bytes
MD5 hash:	86ae7faf59555791f91c85614824d7fc

Chronological Activities

Analysis Process: yakuza.x86.elf PID: 5541, Parent PID: 5538

General

Start time (UTC):	10:07:14
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.x86.elf
Arguments:	-
File size:	142929 bytes
MD5 hash:	86ae7faf59555791f91c85614824d7fc

Chronological Activities

Analysis Process: sh PID: 5541, Parent PID: 5538

General

Start time (UTC):	10:07:14
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 902i13 \|\| busybox pkill -9 902i13"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5542, Parent PID: 5541

General

Start time (UTC):	10:07:14
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5542, Parent PID: 5541

General

Start time (UTC):	10:07:14
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 902i13
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5543, Parent PID: 5541

General

Start time (UTC):	10:07:15
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5543, Parent PID: 5541

General

Start time (UTC):	10:07:15
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 902i13
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.x86.elf PID: 5546, Parent PID: 5538

General

Start time (UTC):	10:07:16
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.x86.elf
Arguments:	-
File size:	142929 bytes
MD5 hash:	86ae7faf59555791f91c85614824d7fc

Chronological Activities

Analysis Process: sh PID: 5546, Parent PID: 5538

General

Start time (UTC):	10:07:16
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 BzSxLxBxeY \|\| busybox pkill -9 BzSxLxBxeY"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5547, Parent PID: 5546

General

Start time (UTC):	10:07:16
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5547, Parent PID: 5546

General

Start time (UTC):	10:07:16
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 BzSxLxBxeY
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5548, Parent PID: 5546

General

Start time (UTC):	10:07:17
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5548, Parent PID: 5546

General

Start time (UTC):	10:07:17
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 BzSxLxBxeY
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.x86.elf PID: 5549, Parent PID: 5538

General

Start time (UTC):	10:07:18
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.x86.elf
Arguments:	-
File size:	142929 bytes
MD5 hash:	86ae7faf59555791f91c85614824d7fc

Chronological Activities

Analysis Process: sh PID: 5549, Parent PID: 5538

General

Start time (UTC):	10:07:18
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 HOHO-LUGO7 \|\| busybox pkill -9 HOHO-LUGO7"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5550, Parent PID: 5549

General

Start time (UTC):	10:07:18
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5550, Parent PID: 5549

General

Start time (UTC):	10:07:18
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 HOHO-LUGO7
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5551, Parent PID: 5549

General

Start time (UTC):	10:07:19
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5551, Parent PID: 5549

General

Start time (UTC):	10:07:19
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 HOHO-LUGO7
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.x86.elf PID: 5554, Parent PID: 5538

General

Start time (UTC):	10:07:20
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.x86.elf
Arguments:	-
File size:	142929 bytes
MD5 hash:	86ae7faf59555791f91c85614824d7fc

Chronological Activities

Analysis Process: sh PID: 5554, Parent PID: 5538

General

Start time (UTC):	10:07:20
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 HOHO-U79OL \|\| busybox pkill -9 HOHO-U79OL"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5555, Parent PID: 5554

General

Start time (UTC):	10:07:20
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5555, Parent PID: 5554

General

Start time (UTC):	10:07:20
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 HOHO-U79OL
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5556, Parent PID: 5554

General

Start time (UTC):	10:07:22
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5556, Parent PID: 5554

General

Start time (UTC):	10:07:22
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 HOHO-U79OL
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.x86.elf PID: 5557, Parent PID: 5538

General

Start time (UTC):	10:07:23
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.x86.elf
Arguments:	-
File size:	142929 bytes
MD5 hash:	86ae7faf59555791f91c85614824d7fc

Chronological Activities

Analysis Process: sh PID: 5557, Parent PID: 5538

General

Start time (UTC):	10:07:23
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 JuYfouyf87 \|\| busybox pkill -9 JuYfouyf87"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5558, Parent PID: 5557

General

Start time (UTC):	10:07:23
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5558, Parent PID: 5557

General

Start time (UTC):	10:07:23
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 JuYfouyf87
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5559, Parent PID: 5557

General

Start time (UTC):	10:07:25
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5559, Parent PID: 5557

General

Start time (UTC):	10:07:25
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 JuYfouyf87
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.x86.elf PID: 5562, Parent PID: 5538

General

Start time (UTC):	10:07:26
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.x86.elf
Arguments:	-
File size:	142929 bytes
MD5 hash:	86ae7faf59555791f91c85614824d7fc

Chronological Activities

Analysis Process: sh PID: 5562, Parent PID: 5538

General

Start time (UTC):	10:07:26
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 NiGGeR69xd \|\| busybox pkill -9 NiGGeR69xd"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5563, Parent PID: 5562

General

Start time (UTC):	10:07:26
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5563, Parent PID: 5562

General

Start time (UTC):	10:07:26
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 NiGGeR69xd
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5564, Parent PID: 5562

General

Start time (UTC):	10:07:27
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5564, Parent PID: 5562

General

Start time (UTC):	10:07:27
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 NiGGeR69xd
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.x86.elf PID: 5565, Parent PID: 5538

General

Start time (UTC):	10:07:28
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.x86.elf
Arguments:	-
File size:	142929 bytes
MD5 hash:	86ae7faf59555791f91c85614824d7fc

Chronological Activities

Analysis Process: sh PID: 5565, Parent PID: 5538

General

Start time (UTC):	10:07:28
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 SO190Ij1X \|\| busybox pkill -9 SO190Ij1X"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5566, Parent PID: 5565

General

Start time (UTC):	10:07:28
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5566, Parent PID: 5565

General

Start time (UTC):	10:07:28
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 SO190Ij1X
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5567, Parent PID: 5565

General

Start time (UTC):	10:07:29
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5567, Parent PID: 5565

General

Start time (UTC):	10:07:29
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 SO190Ij1X
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.x86.elf PID: 5570, Parent PID: 5538

General

Start time (UTC):	10:07:30
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.x86.elf
Arguments:	-
File size:	142929 bytes
MD5 hash:	86ae7faf59555791f91c85614824d7fc

Chronological Activities

Analysis Process: sh PID: 5570, Parent PID: 5538

General

Start time (UTC):	10:07:30
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 LOLKIKEEEDDE \|\| busybox pkill -9 LOLKIKEEEDDE"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5571, Parent PID: 5570

General

Start time (UTC):	10:07:30
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5571, Parent PID: 5570

General

Start time (UTC):	10:07:30
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 LOLKIKEEEDDE
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5572, Parent PID: 5570

General

Start time (UTC):	10:07:32
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5572, Parent PID: 5570

General

Start time (UTC):	10:07:32
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 LOLKIKEEEDDE
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.x86.elf PID: 5573, Parent PID: 5538

General

Start time (UTC):	10:07:33
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.x86.elf
Arguments:	-
File size:	142929 bytes
MD5 hash:	86ae7faf59555791f91c85614824d7fc

Chronological Activities

Analysis Process: sh PID: 5573, Parent PID: 5538

General

Start time (UTC):	10:07:33
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 ekjheory98e \|\| busybox pkill -9 ekjheory98e"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5574, Parent PID: 5573

General

Start time (UTC):	10:07:33
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5574, Parent PID: 5573

General

Start time (UTC):	10:07:33
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 ekjheory98e
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5575, Parent PID: 5573

General

Start time (UTC):	10:07:34
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5575, Parent PID: 5573

General

Start time (UTC):	10:07:34
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 ekjheory98e
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.x86.elf PID: 5597, Parent PID: 5538

General

Start time (UTC):	10:07:35
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.x86.elf
Arguments:	-
File size:	142929 bytes
MD5 hash:	86ae7faf59555791f91c85614824d7fc

Chronological Activities

Analysis Process: sh PID: 5597, Parent PID: 5538

General

Start time (UTC):	10:07:35
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 scansh4 \|\| busybox pkill -9 scansh4"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5598, Parent PID: 5597

General

Start time (UTC):	10:07:35
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5598, Parent PID: 5597

General

Start time (UTC):	10:07:35
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 scansh4
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5599, Parent PID: 5597

General

Start time (UTC):	10:07:36
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5599, Parent PID: 5597

General

Start time (UTC):	10:07:36
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 scansh4
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.x86.elf PID: 5600, Parent PID: 5538

General

Start time (UTC):	10:07:37
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.x86.elf
Arguments:	-
File size:	142929 bytes
MD5 hash:	86ae7faf59555791f91c85614824d7fc

Chronological Activities

Analysis Process: sh PID: 5600, Parent PID: 5538

General

Start time (UTC):	10:07:37
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 MDMA \|\| busybox pkill -9 MDMA"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5601, Parent PID: 5600

General

Start time (UTC):	10:07:37
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5601, Parent PID: 5600

General

Start time (UTC):	10:07:37
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 MDMA
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5602, Parent PID: 5600

General

Start time (UTC):	10:07:39
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5602, Parent PID: 5600

General

Start time (UTC):	10:07:39
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 MDMA
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.x86.elf PID: 5604, Parent PID: 5538

General

Start time (UTC):	10:07:40
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.x86.elf
Arguments:	-
File size:	142929 bytes
MD5 hash:	86ae7faf59555791f91c85614824d7fc

Chronological Activities

Analysis Process: sh PID: 5604, Parent PID: 5538

General

Start time (UTC):	10:07:40
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 fdevalvex \|\| busybox pkill -9 fdevalvex"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5605, Parent PID: 5604

General

Start time (UTC):	10:07:40
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5605, Parent PID: 5604

General

Start time (UTC):	10:07:40
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 fdevalvex
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5608, Parent PID: 5604

General

Start time (UTC):	10:07:41
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5608, Parent PID: 5604

General

Start time (UTC):	10:07:41
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 fdevalvex
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.x86.elf PID: 5609, Parent PID: 5538

General

Start time (UTC):	10:07:42
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.x86.elf
Arguments:	-
File size:	142929 bytes
MD5 hash:	86ae7faf59555791f91c85614824d7fc

Chronological Activities

Analysis Process: sh PID: 5609, Parent PID: 5538

General

Start time (UTC):	10:07:42
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 scanspc \|\| busybox pkill -9 scanspc"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5610, Parent PID: 5609

General

Start time (UTC):	10:07:42
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5610, Parent PID: 5609

General

Start time (UTC):	10:07:42
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 scanspc
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5611, Parent PID: 5609

General

Start time (UTC):	10:07:43
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5611, Parent PID: 5609

General

Start time (UTC):	10:07:43
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 scanspc
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.x86.elf PID: 5612, Parent PID: 5538

General

Start time (UTC):	10:07:44
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.x86.elf
Arguments:	-
File size:	142929 bytes
MD5 hash:	86ae7faf59555791f91c85614824d7fc

Chronological Activities

Analysis Process: sh PID: 5612, Parent PID: 5538

General

Start time (UTC):	10:07:44
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 MELTEDNINJAREALZ \|\| busybox pkill -9 MELTEDNINJAREALZ"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5613, Parent PID: 5612

General

Start time (UTC):	10:07:44
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5613, Parent PID: 5612

General

Start time (UTC):	10:07:44
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 MELTEDNINJAREALZ
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5616, Parent PID: 5612

General

Start time (UTC):	10:07:45
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 5616, Parent PID: 5612

General

Start time (UTC):	10:07:45
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 MELTEDNINJAREALZ
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.x86.elf PID: 5617, Parent PID: 5538

General

Start time (UTC):	10:07:46
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.x86.elf
Arguments:	-
File size:	142929 bytes
MD5 hash:	86ae7faf59555791f91c85614824d7fc

Chronological Activities

Analysis Process: sh PID: 5617, Parent PID: 5538

General

Start time (UTC):	10:07:46
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 flexsonskids \|\| busybox pkill -9 flexsonskids"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 5618, Parent PID: 5617

General

Start time (UTC):	10:07:46
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 5618, Parent PID: 5617

General

Start time (UTC):	10:07:46
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 flexsonskids
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 5619, Parent PID: 5617

General

Start time (UTC):	10:07:48
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5619, Parent PID: 5617

General

Start time (UTC):	10:07:48
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 flexsonskids
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.x86.elf PID: 5620, Parent PID: 5538

General

Start time (UTC):	10:07:49
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.x86.elf
Arguments:	-
File size:	142929 bytes
MD5 hash:	86ae7faf59555791f91c85614824d7fc

Analysis Process: sh PID: 5620, Parent PID: 5538

General

Start time (UTC):	10:07:49
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 scanx86 \|\| busybox pkill -9 scanx86"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5621, Parent PID: 5620

General

Start time (UTC):	10:07:49
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5621, Parent PID: 5620

General

Start time (UTC):	10:07:49
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 scanx86
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5624, Parent PID: 5620

General

Start time (UTC):	10:07:50
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5624, Parent PID: 5620

General

Start time (UTC):	10:07:50
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 scanx86
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.x86.elf PID: 5625, Parent PID: 5538

General

Start time (UTC):	10:07:51
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.x86.elf
Arguments:	-
File size:	142929 bytes
MD5 hash:	86ae7faf59555791f91c85614824d7fc

Analysis Process: sh PID: 5625, Parent PID: 5538

General

Start time (UTC):	10:07:51
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 MISAKI-U79OL \|\| busybox pkill -9 MISAKI-U79OL"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5626, Parent PID: 5625

General

Start time (UTC):	10:07:51
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5626, Parent PID: 5625

General

Start time (UTC):	10:07:51
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 MISAKI-U79OL
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5627, Parent PID: 5625

General

Start time (UTC):	10:07:53
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5627, Parent PID: 5625

General

Start time (UTC):	10:07:53
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 MISAKI-U79OL
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.x86.elf PID: 5628, Parent PID: 5538

General

Start time (UTC):	10:07:54
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.x86.elf
Arguments:	-
File size:	142929 bytes
MD5 hash:	86ae7faf59555791f91c85614824d7fc

Analysis Process: sh PID: 5628, Parent PID: 5538

General

Start time (UTC):	10:07:54
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 foAxi102kxe \|\| busybox pkill -9 foAxi102kxe"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5629, Parent PID: 5628

General

Start time (UTC):	10:07:54
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5629, Parent PID: 5628

General

Start time (UTC):	10:07:54
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 foAxi102kxe
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5632, Parent PID: 5628

General

Start time (UTC):	10:07:56
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5632, Parent PID: 5628

General

Start time (UTC):	10:07:56
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 foAxi102kxe
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.x86.elf PID: 5633, Parent PID: 5538

General

Start time (UTC):	10:07:57
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.x86.elf
Arguments:	-
File size:	142929 bytes
MD5 hash:	86ae7faf59555791f91c85614824d7fc

Analysis Process: sh PID: 5633, Parent PID: 5538

General

Start time (UTC):	10:07:57
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 swodjwodjwoj \|\| busybox pkill -9 swodjwodjwoj"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5634, Parent PID: 5633

General

Start time (UTC):	10:07:57
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5634, Parent PID: 5633

General

Start time (UTC):	10:07:57
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 swodjwodjwoj
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5635, Parent PID: 5633

General

Start time (UTC):	10:07:58
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5635, Parent PID: 5633

General

Start time (UTC):	10:07:58
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 swodjwodjwoj
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.x86.elf PID: 5636, Parent PID: 5538

General

Start time (UTC):	10:07:59
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.x86.elf
Arguments:	-
File size:	142929 bytes
MD5 hash:	86ae7faf59555791f91c85614824d7fc

Analysis Process: sh PID: 5636, Parent PID: 5538

General

Start time (UTC):	10:07:59
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 MmKiy7f87l \|\| busybox pkill -9 MmKiy7f87l"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5637, Parent PID: 5636

General

Start time (UTC):	10:07:59
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5637, Parent PID: 5636

General

Start time (UTC):	10:07:59
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 MmKiy7f87l
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5640, Parent PID: 5636

General

Start time (UTC):	10:08:00
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5640, Parent PID: 5636

General

Start time (UTC):	10:08:00
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 MmKiy7f87l
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.x86.elf PID: 5641, Parent PID: 5538

General

Start time (UTC):	10:08:01
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.x86.elf
Arguments:	-
File size:	142929 bytes
MD5 hash:	86ae7faf59555791f91c85614824d7fc

Analysis Process: sh PID: 5641, Parent PID: 5538

General

Start time (UTC):	10:08:01
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 freecookiex86 \|\| busybox pkill -9 freecookiex86"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5642, Parent PID: 5641

General

Start time (UTC):	10:08:01
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5642, Parent PID: 5641

General

Start time (UTC):	10:08:01
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 freecookiex86
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5643, Parent PID: 5641

General

Start time (UTC):	10:08:03
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5643, Parent PID: 5641

General

Start time (UTC):	10:08:03
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 freecookiex86
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.x86.elf PID: 5644, Parent PID: 5538

General

Start time (UTC):	10:08:04
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.x86.elf
Arguments:	-
File size:	142929 bytes
MD5 hash:	86ae7faf59555791f91c85614824d7fc

Analysis Process: sh PID: 5644, Parent PID: 5538

General

Start time (UTC):	10:08:04
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 sysgpu \|\| busybox pkill -9 sysgpu"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5645, Parent PID: 5644

General

Start time (UTC):	10:08:04
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5645, Parent PID: 5644

General

Start time (UTC):	10:08:04
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 sysgpu
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5648, Parent PID: 5644

General

Start time (UTC):	10:08:05
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5648, Parent PID: 5644

General

Start time (UTC):	10:08:05
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 sysgpu
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.x86.elf PID: 5651, Parent PID: 5538

General

Start time (UTC):	10:08:06
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.x86.elf
Arguments:	-
File size:	142929 bytes
MD5 hash:	86ae7faf59555791f91c85614824d7fc

Analysis Process: sh PID: 5651, Parent PID: 5538

General

Start time (UTC):	10:08:06
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 NiGGeR69xd \|\| busybox pkill -9 NiGGeR69xd"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5652, Parent PID: 5651

General

Start time (UTC):	10:08:06
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5652, Parent PID: 5651

General

Start time (UTC):	10:08:06
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 NiGGeR69xd
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5653, Parent PID: 5651

General

Start time (UTC):	10:08:08
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5653, Parent PID: 5651

General

Start time (UTC):	10:08:08
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 NiGGeR69xd
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.x86.elf PID: 5654, Parent PID: 5538

General

Start time (UTC):	10:08:09
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.x86.elf
Arguments:	-
File size:	142929 bytes
MD5 hash:	86ae7faf59555791f91c85614824d7fc

Analysis Process: sh PID: 5654, Parent PID: 5538

General

Start time (UTC):	10:08:09
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 frgege \|\| busybox pkill -9 frgege"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5655, Parent PID: 5654

General

Start time (UTC):	10:08:09
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5655, Parent PID: 5654

General

Start time (UTC):	10:08:09
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 frgege
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5657, Parent PID: 5654

General

Start time (UTC):	10:08:10
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5657, Parent PID: 5654

General

Start time (UTC):	10:08:10
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 frgege
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.x86.elf PID: 5660, Parent PID: 5538

General

Start time (UTC):	10:08:11
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.x86.elf
Arguments:	-
File size:	142929 bytes
MD5 hash:	86ae7faf59555791f91c85614824d7fc

Analysis Process: sh PID: 5660, Parent PID: 5538

General

Start time (UTC):	10:08:11
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 sysupdater \|\| busybox pkill -9 sysupdater"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5661, Parent PID: 5660

General

Start time (UTC):	10:08:11
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5661, Parent PID: 5660

General

Start time (UTC):	10:08:11
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 sysupdater
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5662, Parent PID: 5660

General

Start time (UTC):	10:08:12
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5662, Parent PID: 5660

General

Start time (UTC):	10:08:12
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 sysupdater
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.x86.elf PID: 5663, Parent PID: 5538

General

Start time (UTC):	10:08:13
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.x86.elf
Arguments:	-
File size:	142929 bytes
MD5 hash:	86ae7faf59555791f91c85614824d7fc

Analysis Process: sh PID: 5663, Parent PID: 5538

General

Start time (UTC):	10:08:13
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 0DnAzepd \|\| busybox pkill -9 0DnAzepd"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5664, Parent PID: 5663

General

Start time (UTC):	10:08:13
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5664, Parent PID: 5663

General

Start time (UTC):	10:08:13
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 0DnAzepd
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5665, Parent PID: 5663

General

Start time (UTC):	10:08:15
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5665, Parent PID: 5663

General

Start time (UTC):	10:08:15
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 0DnAzepd
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.x86.elf PID: 5668, Parent PID: 5538

General

Start time (UTC):	10:08:16
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.x86.elf
Arguments:	-
File size:	142929 bytes
MD5 hash:	86ae7faf59555791f91c85614824d7fc

Analysis Process: sh PID: 5668, Parent PID: 5538

General

Start time (UTC):	10:08:16
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 NiGGeRD0nks69 \|\| busybox pkill -9 NiGGeRD0nks69"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5669, Parent PID: 5668

General

Start time (UTC):	10:08:16
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5669, Parent PID: 5668

General

Start time (UTC):	10:08:16
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 NiGGeRD0nks69
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5670, Parent PID: 5668

General

Start time (UTC):	10:08:17
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5670, Parent PID: 5668

General

Start time (UTC):	10:08:17
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 NiGGeRD0nks69
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.x86.elf PID: 5671, Parent PID: 5538

General

Start time (UTC):	10:08:18
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.x86.elf
Arguments:	-
File size:	142929 bytes
MD5 hash:	86ae7faf59555791f91c85614824d7fc

Analysis Process: sh PID: 5671, Parent PID: 5538

General

Start time (UTC):	10:08:18
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 frgreu \|\| busybox pkill -9 frgreu"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5672, Parent PID: 5671

General

Start time (UTC):	10:08:18
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5672, Parent PID: 5671

General

Start time (UTC):	10:08:18
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 frgreu
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5673, Parent PID: 5671

General

Start time (UTC):	10:08:19
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5673, Parent PID: 5671

General

Start time (UTC):	10:08:19
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 frgreu
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.x86.elf PID: 5676, Parent PID: 5538

General

Start time (UTC):	10:08:20
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.x86.elf
Arguments:	-
File size:	142929 bytes
MD5 hash:	86ae7faf59555791f91c85614824d7fc

Analysis Process: sh PID: 5676, Parent PID: 5538

General

Start time (UTC):	10:08:20
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 telnetd \|\| busybox pkill -9 telnetd"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5677, Parent PID: 5676

General

Start time (UTC):	10:08:20
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5677, Parent PID: 5676

General

Start time (UTC):	10:08:20
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 telnetd
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5678, Parent PID: 5676

General

Start time (UTC):	10:08:21
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5678, Parent PID: 5676

General

Start time (UTC):	10:08:21
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 telnetd
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.x86.elf PID: 5679, Parent PID: 5538

General

Start time (UTC):	10:08:22
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.x86.elf
Arguments:	-
File size:	142929 bytes
MD5 hash:	86ae7faf59555791f91c85614824d7fc

Analysis Process: sh PID: 5679, Parent PID: 5538

General

Start time (UTC):	10:08:22
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 0x766f6964 \|\| busybox pkill -9 0x766f6964"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5680, Parent PID: 5679

General

Start time (UTC):	10:08:22
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5680, Parent PID: 5679

General

Start time (UTC):	10:08:22
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 0x766f6964
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5681, Parent PID: 5679

General

Start time (UTC):	10:08:24
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5681, Parent PID: 5679

General

Start time (UTC):	10:08:24
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 0x766f6964
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.x86.elf PID: 5682, Parent PID: 5538

General

Start time (UTC):	10:08:25
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.x86.elf
Arguments:	-
File size:	142929 bytes
MD5 hash:	86ae7faf59555791f91c85614824d7fc

Analysis Process: sh PID: 5682, Parent PID: 5538

General

Start time (UTC):	10:08:25
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 NiGGeRd0nks1337 \|\| busybox pkill -9 NiGGeRd0nks1337"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5683, Parent PID: 5682

General

Start time (UTC):	10:08:25
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5683, Parent PID: 5682

General

Start time (UTC):	10:08:25
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 NiGGeRd0nks1337
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5686, Parent PID: 5682

General

Start time (UTC):	10:08:26
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5686, Parent PID: 5682

General

Start time (UTC):	10:08:26
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 NiGGeRd0nks1337
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.x86.elf PID: 5687, Parent PID: 5538

General

Start time (UTC):	10:08:27
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.x86.elf
Arguments:	-
File size:	142929 bytes
MD5 hash:	86ae7faf59555791f91c85614824d7fc

Analysis Process: sh PID: 5687, Parent PID: 5538

General

Start time (UTC):	10:08:27
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 gaft \|\| busybox pkill -9 gaft"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5688, Parent PID: 5687

General

Start time (UTC):	10:08:27
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5688, Parent PID: 5687

General

Start time (UTC):	10:08:27
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 gaft
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5689, Parent PID: 5687

General

Start time (UTC):	10:08:28
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5689, Parent PID: 5687

General

Start time (UTC):	10:08:28
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 gaft
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.x86.elf PID: 5690, Parent PID: 5538

General

Start time (UTC):	10:08:29
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.x86.elf
Arguments:	-
File size:	142929 bytes
MD5 hash:	86ae7faf59555791f91c85614824d7fc

Analysis Process: sh PID: 5690, Parent PID: 5538

General

Start time (UTC):	10:08:29
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 urasgbsigboa \|\| busybox pkill -9 urasgbsigboa"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5691, Parent PID: 5690

General

Start time (UTC):	10:08:29
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5691, Parent PID: 5690

General

Start time (UTC):	10:08:29
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 urasgbsigboa
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5694, Parent PID: 5690

General

Start time (UTC):	10:08:31
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5694, Parent PID: 5690

General

Start time (UTC):	10:08:31
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 urasgbsigboa
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.x86.elf PID: 5695, Parent PID: 5538

General

Start time (UTC):	10:08:32
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.x86.elf
Arguments:	-
File size:	142929 bytes
MD5 hash:	86ae7faf59555791f91c85614824d7fc

Analysis Process: sh PID: 5695, Parent PID: 5538

General

Start time (UTC):	10:08:32
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 120i3UI49 \|\| busybox pkill -9 120i3UI49"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5696, Parent PID: 5695

General

Start time (UTC):	10:08:32
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5696, Parent PID: 5695

General

Start time (UTC):	10:08:32
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 120i3UI49
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5697, Parent PID: 5695

General

Start time (UTC):	10:08:33
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5697, Parent PID: 5695

General

Start time (UTC):	10:08:33
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 120i3UI49
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.x86.elf PID: 5698, Parent PID: 5538

General

Start time (UTC):	10:08:34
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.x86.elf
Arguments:	-
File size:	142929 bytes
MD5 hash:	86ae7faf59555791f91c85614824d7fc

Analysis Process: sh PID: 5698, Parent PID: 5538

General

Start time (UTC):	10:08:34
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 OaF3 \|\| busybox pkill -9 OaF3"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5699, Parent PID: 5698

General

Start time (UTC):	10:08:34
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5699, Parent PID: 5698

General

Start time (UTC):	10:08:34
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 OaF3
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5702, Parent PID: 5698

General

Start time (UTC):	10:08:35
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5702, Parent PID: 5698

General

Start time (UTC):	10:08:35
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 OaF3
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.x86.elf PID: 5703, Parent PID: 5538

General

Start time (UTC):	10:08:36
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.x86.elf
Arguments:	-
File size:	142929 bytes
MD5 hash:	86ae7faf59555791f91c85614824d7fc

Analysis Process: sh PID: 5703, Parent PID: 5538

General

Start time (UTC):	10:08:36
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 geae \|\| busybox pkill -9 geae"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5704, Parent PID: 5703

General

Start time (UTC):	10:08:36
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5704, Parent PID: 5703

General

Start time (UTC):	10:08:36
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 geae
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5705, Parent PID: 5703

General

Start time (UTC):	10:08:37
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5705, Parent PID: 5703

General

Start time (UTC):	10:08:37
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 geae
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.x86.elf PID: 5706, Parent PID: 5538

General

Start time (UTC):	10:08:38
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.x86.elf
Arguments:	-
File size:	142929 bytes
MD5 hash:	86ae7faf59555791f91c85614824d7fc

Analysis Process: sh PID: 5706, Parent PID: 5538

General

Start time (UTC):	10:08:38
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 vaiolmao \|\| busybox pkill -9 vaiolmao"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5707, Parent PID: 5706

General

Start time (UTC):	10:08:38
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5707, Parent PID: 5706

General

Start time (UTC):	10:08:38
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 vaiolmao
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5709, Parent PID: 5706

General

Start time (UTC):	10:08:40
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5709, Parent PID: 5706

General

Start time (UTC):	10:08:40
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 vaiolmao
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.x86.elf PID: 5712, Parent PID: 5538

General

Start time (UTC):	10:08:41
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.x86.elf
Arguments:	-
File size:	142929 bytes
MD5 hash:	86ae7faf59555791f91c85614824d7fc

Analysis Process: sh PID: 5712, Parent PID: 5538

General

Start time (UTC):	10:08:41
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 123123a \|\| busybox pkill -9 123123a"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5713, Parent PID: 5712

General

Start time (UTC):	10:08:41
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5713, Parent PID: 5712

General

Start time (UTC):	10:08:41
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 123123a
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5714, Parent PID: 5712

General

Start time (UTC):	10:08:42
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5714, Parent PID: 5712

General

Start time (UTC):	10:08:42
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 123123a
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.x86.elf PID: 5715, Parent PID: 5538

General

Start time (UTC):	10:08:43
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.x86.elf
Arguments:	-
File size:	142929 bytes
MD5 hash:	86ae7faf59555791f91c85614824d7fc

Analysis Process: sh PID: 5715, Parent PID: 5538

General

Start time (UTC):	10:08:43
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 Ofurain0n4H34D \|\| busybox pkill -9 Ofurain0n4H34D"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5716, Parent PID: 5715

General

Start time (UTC):	10:08:43
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5716, Parent PID: 5715

General

Start time (UTC):	10:08:43
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 Ofurain0n4H34D
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5717, Parent PID: 5715

General

Start time (UTC):	10:08:44
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5717, Parent PID: 5715

General

Start time (UTC):	10:08:44
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 Ofurain0n4H34D
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.x86.elf PID: 5720, Parent PID: 5538

General

Start time (UTC):	10:08:45
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.x86.elf
Arguments:	-
File size:	142929 bytes
MD5 hash:	86ae7faf59555791f91c85614824d7fc

Analysis Process: sh PID: 5720, Parent PID: 5538

General

Start time (UTC):	10:08:45
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 ggTrex \|\| busybox pkill -9 ggTrex"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5721, Parent PID: 5720

General

Start time (UTC):	10:08:45
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5721, Parent PID: 5720

General

Start time (UTC):	10:08:45
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 ggTrex
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5722, Parent PID: 5720

General

Start time (UTC):	10:08:47
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5722, Parent PID: 5720

General

Start time (UTC):	10:08:47
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 ggTrex
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.x86.elf PID: 5723, Parent PID: 5538

General

Start time (UTC):	10:08:48
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.x86.elf
Arguments:	-
File size:	142929 bytes
MD5 hash:	86ae7faf59555791f91c85614824d7fc

Analysis Process: sh PID: 5723, Parent PID: 5538

General

Start time (UTC):	10:08:48
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 wasads \|\| busybox pkill -9 wasads"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5724, Parent PID: 5723

General

Start time (UTC):	10:08:48
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5724, Parent PID: 5723

General

Start time (UTC):	10:08:48
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 wasads
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5725, Parent PID: 5723

General

Start time (UTC):	10:08:49
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5725, Parent PID: 5723

General

Start time (UTC):	10:08:49
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 wasads
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.x86.elf PID: 5728, Parent PID: 5538

General

Start time (UTC):	10:08:50
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.x86.elf
Arguments:	-
File size:	142929 bytes
MD5 hash:	86ae7faf59555791f91c85614824d7fc

Analysis Process: sh PID: 5728, Parent PID: 5538

General

Start time (UTC):	10:08:50
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 1293194hjXD \|\| busybox pkill -9 1293194hjXD"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5729, Parent PID: 5728

General

Start time (UTC):	10:08:50
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5729, Parent PID: 5728

General

Start time (UTC):	10:08:50
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 1293194hjXD
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5730, Parent PID: 5728

General

Start time (UTC):	10:08:52
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5730, Parent PID: 5728

General

Start time (UTC):	10:08:52
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 1293194hjXD
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.x86.elf PID: 5731, Parent PID: 5538

General

Start time (UTC):	10:08:53
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.x86.elf
Arguments:	-
File size:	142929 bytes
MD5 hash:	86ae7faf59555791f91c85614824d7fc

Analysis Process: sh PID: 5731, Parent PID: 5538

General

Start time (UTC):	10:08:53
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 OthLaLosn \|\| busybox pkill -9 OthLaLosn"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5732, Parent PID: 5731

General

Start time (UTC):	10:08:53
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5732, Parent PID: 5731

General

Start time (UTC):	10:08:53
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 OthLaLosn
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5733, Parent PID: 5731

General

Start time (UTC):	10:08:54
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5733, Parent PID: 5731

General

Start time (UTC):	10:08:54
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 OthLaLosn
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.x86.elf PID: 5736, Parent PID: 5538

General

Start time (UTC):	10:08:55
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.x86.elf
Arguments:	-
File size:	142929 bytes
MD5 hash:	86ae7faf59555791f91c85614824d7fc

Analysis Process: sh PID: 5736, Parent PID: 5538

General

Start time (UTC):	10:08:55
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 ggt \|\| busybox pkill -9 ggt"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5737, Parent PID: 5736

General

Start time (UTC):	10:08:55
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5737, Parent PID: 5736

General

Start time (UTC):	10:08:55
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 ggt
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5738, Parent PID: 5736

General

Start time (UTC):	10:08:57
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5738, Parent PID: 5736

General

Start time (UTC):	10:08:57
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 ggt
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.x86.elf PID: 5739, Parent PID: 5538

General

Start time (UTC):	10:08:58
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.x86.elf
Arguments:	-
File size:	142929 bytes
MD5 hash:	86ae7faf59555791f91c85614824d7fc

Analysis Process: sh PID: 5739, Parent PID: 5538

General

Start time (UTC):	10:08:58
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 wget-log \|\| busybox pkill -9 wget-log"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5740, Parent PID: 5739

General

Start time (UTC):	10:08:58
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5740, Parent PID: 5739

General

Start time (UTC):	10:08:58
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 wget-log
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5741, Parent PID: 5739

General

Start time (UTC):	10:09:00
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5741, Parent PID: 5739

General

Start time (UTC):	10:09:00
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 wget-log
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.x86.elf PID: 5744, Parent PID: 5538

General

Start time (UTC):	10:09:01
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.x86.elf
Arguments:	-
File size:	142929 bytes
MD5 hash:	86ae7faf59555791f91c85614824d7fc

Analysis Process: sh PID: 5744, Parent PID: 5538

General

Start time (UTC):	10:09:01
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 1337SoraLOADER \|\| busybox pkill -9 1337SoraLOADER"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5745, Parent PID: 5744

General

Start time (UTC):	10:09:01
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5745, Parent PID: 5744

General

Start time (UTC):	10:09:01
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 1337SoraLOADER
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5746, Parent PID: 5744

General

Start time (UTC):	10:09:02
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5746, Parent PID: 5744

General

Start time (UTC):	10:09:02
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 1337SoraLOADER
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.x86.elf PID: 5747, Parent PID: 5538

General

Start time (UTC):	10:09:03
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.x86.elf
Arguments:	-
File size:	142929 bytes
MD5 hash:	86ae7faf59555791f91c85614824d7fc

Analysis Process: sh PID: 5747, Parent PID: 5538

General

Start time (UTC):	10:09:03
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 SAIAKINA \|\| busybox pkill -9 SAIAKINA"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5748, Parent PID: 5747

General

Start time (UTC):	10:09:03
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5748, Parent PID: 5747

General

Start time (UTC):	10:09:03
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 SAIAKINA
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5751, Parent PID: 5747

General

Start time (UTC):	10:09:05
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5751, Parent PID: 5747

General

Start time (UTC):	10:09:05
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 SAIAKINA
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.x86.elf PID: 5754, Parent PID: 5538

General

Start time (UTC):	10:09:06
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.x86.elf
Arguments:	-
File size:	142929 bytes
MD5 hash:	86ae7faf59555791f91c85614824d7fc

Analysis Process: sh PID: 5754, Parent PID: 5538

General

Start time (UTC):	10:09:06
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 ggtq \|\| busybox pkill -9 ggtq"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5755, Parent PID: 5754

General

Start time (UTC):	10:09:06
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5755, Parent PID: 5754

General

Start time (UTC):	10:09:06
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 ggtq
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5756, Parent PID: 5754

General

Start time (UTC):	10:09:07
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5756, Parent PID: 5754

General

Start time (UTC):	10:09:07
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 ggtq
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.x86.elf PID: 5757, Parent PID: 5538

General

Start time (UTC):	10:09:08
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.x86.elf
Arguments:	-
File size:	142929 bytes
MD5 hash:	86ae7faf59555791f91c85614824d7fc

Analysis Process: sh PID: 5757, Parent PID: 5538

General

Start time (UTC):	10:09:08
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 1378bfp919GRB1Q2 \|\| busybox pkill -9 1378bfp919GRB1Q2"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5758, Parent PID: 5757

General

Start time (UTC):	10:09:08
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5758, Parent PID: 5757

General

Start time (UTC):	10:09:08
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 1378bfp919GRB1Q2
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5760, Parent PID: 5757

General

Start time (UTC):	10:09:09
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5760, Parent PID: 5757

General

Start time (UTC):	10:09:09
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 1378bfp919GRB1Q2
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.x86.elf PID: 5763, Parent PID: 5538

General

Start time (UTC):	10:09:10
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.x86.elf
Arguments:	-
File size:	142929 bytes
MD5 hash:	86ae7faf59555791f91c85614824d7fc

Analysis Process: sh PID: 5763, Parent PID: 5538

General

Start time (UTC):	10:09:10
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 SAIAKUSO \|\| busybox pkill -9 SAIAKUSO"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5764, Parent PID: 5763

General

Start time (UTC):	10:09:10
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5764, Parent PID: 5763

General

Start time (UTC):	10:09:10
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 SAIAKUSO
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5765, Parent PID: 5763

General

Start time (UTC):	10:09:12
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5765, Parent PID: 5763

General

Start time (UTC):	10:09:12
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 SAIAKUSO
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.x86.elf PID: 5766, Parent PID: 5538

General

Start time (UTC):	10:09:13
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.x86.elf
Arguments:	-
File size:	142929 bytes
MD5 hash:	86ae7faf59555791f91c85614824d7fc

Analysis Process: sh PID: 5766, Parent PID: 5538

General

Start time (UTC):	10:09:13
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 ggtr \|\| busybox pkill -9 ggtr"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5767, Parent PID: 5766

General

Start time (UTC):	10:09:13
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5767, Parent PID: 5766

General

Start time (UTC):	10:09:13
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 ggtr
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5768, Parent PID: 5766

General

Start time (UTC):	10:09:14
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5768, Parent PID: 5766

General

Start time (UTC):	10:09:14
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 ggtr
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.x86.elf PID: 5771, Parent PID: 5538

General

Start time (UTC):	10:09:15
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.x86.elf
Arguments:	-
File size:	142929 bytes
MD5 hash:	86ae7faf59555791f91c85614824d7fc

Analysis Process: sh PID: 5771, Parent PID: 5538

General

Start time (UTC):	10:09:15
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 14Fa \|\| busybox pkill -9 14Fa"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5772, Parent PID: 5771

General

Start time (UTC):	10:09:15
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5772, Parent PID: 5771

General

Start time (UTC):	10:09:15
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 14Fa
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 5773, Parent PID: 5771

General

Start time (UTC):	10:09:17
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 5773, Parent PID: 5771

General

Start time (UTC):	10:09:17
Start date (UTC):	23/11/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 14Fa
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.x86.elf PID: 5774, Parent PID: 5538

General

Start time (UTC):	10:09:18
Start date (UTC):	23/11/2024
Path:	/tmp/yakuza.x86.elf
Arguments:	-
File size:	142929 bytes
MD5 hash:	86ae7faf59555791f91c85614824d7fc

Analysis Process: sh PID: 5774, Parent PID: 5538

General

Start time (UTC):	10:09:18
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 SEXSLAVE1337 \|\| busybox pkill -9 SEXSLAVE1337"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 5775, Parent PID: 5774

General

Start time (UTC):	10:09:18
Start date (UTC):	23/11/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 5775, Parent PID: 5774

General

Start time (UTC):	10:09:18
Start date (UTC):	23/11/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 SEXSLAVE1337
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained. Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism. Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes.
Tactics:	Credential Access
Data Sources:	Application Log: Application Log Content, Command: Command Execution, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report yakuza.x86.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Network Port Distribution

TCP Packets

IRC Packets

System Behavior

Analysis Process: yakuza.x86.elf PID: 5537, Parent PID: 5458

General

Chronological Activities

Analysis Process: yakuza.x86.elf PID: 5538, Parent PID: 5537

General

Chronological Activities

Analysis Process: yakuza.x86.elf PID: 5539, Parent PID: 5538

General

Chronological Activities

Analysis Process: yakuza.x86.elf PID: 5540, Parent PID: 5538

General

Chronological Activities

Analysis Process: yakuza.x86.elf PID: 5541, Parent PID: 5538

General

Chronological Activities

Analysis Process: sh PID: 5541, Parent PID: 5538

Linux Analysis Report
yakuza.x86.elf