Edit tour

Linux Analysis Report
yakuza.ppc.elf

Overview

General Information

Sample name:	yakuza.ppc.elf
Analysis ID:	1581656
MD5:	c664c20d42ee503217b65e793e4b126e
SHA1:	28b8de0c41219ef0fadd15b138ca7a521cf9ef2c
SHA256:	b2ae29e1b6aa1036e7a048153494ea7c34b2e1c40711fafd4adef4b9f829dd38
Tags:	elfuser-abuse_ch
Infos:

Detection

Mirai

Score:	64
Range:	0 - 100
Whitelisted:	false

Signatures

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Yara detected Mirai

Enumerates processes within the "proc" file system

Executes commands using a shell command-line interpreter

Executes the "kill" or "pkill" command typically used to terminate processes

Reads CPU information from /sys indicative of miner or evasive malware

Reads the 'hosts' file potentially containing internal network hosts

Sample and/or dropped files contains symbols with suspicious names

Sample contains strings indicative of BusyBox which embeds multiple Unix commands in a single executable

Sample contains strings indicative of password brute-forcing capabilities

Sample contains strings that are user agent strings indicative of HTTP manipulation

Tries to connect to HTTP servers, but all servers are down (expired dropper behavior)

Uses the "uname" system call to query kernel version information (possible evasion)

Yara signature match

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1581656
Start date and time:	2024-12-28 12:36:05 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	yakuza.ppc.elf
Detection:	MAL
Classification:	mal64.troj.linELF@0/0@1/0

Warnings

Report size exceeded maximum capacity and may have missing behavior information.
VT rate limit hit for: pirati.privatedns.org

Runtime Messages

Command:	/tmp/yakuza.ppc.elf
PID:	6234
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	CAPSAICIN
Standard Error:

Process Tree

system is lnxubuntu20

yakuza.ppc.elf (PID: 6234, Parent: 6156, MD5: ae65271c943d3451b7f026d1fadccea6) Arguments: /tmp/yakuza.ppc.elf

yakuza.ppc.elf New Fork (PID: 6236, Parent: 6234)

yakuza.ppc.elf New Fork (PID: 6242, Parent: 6236)

yakuza.ppc.elf New Fork (PID: 6243, Parent: 6236)

yakuza.ppc.elf New Fork (PID: 6246, Parent: 6236)

sh (PID: 6246, Parent: 6236, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 902i13 || busybox pkill -9 902i13"

sh New Fork (PID: 6251, Parent: 6246)

pkill (PID: 6251, Parent: 6246, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 902i13

sh New Fork (PID: 6266, Parent: 6246)

busybox (PID: 6266, Parent: 6246, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 902i13

yakuza.ppc.elf New Fork (PID: 6267, Parent: 6236)

sh (PID: 6267, Parent: 6236, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 BzSxLxBxeY || busybox pkill -9 BzSxLxBxeY"

sh New Fork (PID: 6272, Parent: 6267)

pkill (PID: 6272, Parent: 6267, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 BzSxLxBxeY

sh New Fork (PID: 6279, Parent: 6267)

busybox (PID: 6279, Parent: 6267, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 BzSxLxBxeY

yakuza.ppc.elf New Fork (PID: 6280, Parent: 6236)

sh (PID: 6280, Parent: 6236, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 HOHO-LUGO7 || busybox pkill -9 HOHO-LUGO7"

sh New Fork (PID: 6282, Parent: 6280)

pkill (PID: 6282, Parent: 6280, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 HOHO-LUGO7

sh New Fork (PID: 6285, Parent: 6280)

busybox (PID: 6285, Parent: 6280, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 HOHO-LUGO7

yakuza.ppc.elf New Fork (PID: 6286, Parent: 6236)

sh (PID: 6286, Parent: 6236, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 HOHO-U79OL || busybox pkill -9 HOHO-U79OL"

sh New Fork (PID: 6288, Parent: 6286)

pkill (PID: 6288, Parent: 6286, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 HOHO-U79OL

sh New Fork (PID: 6289, Parent: 6286)

busybox (PID: 6289, Parent: 6286, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 HOHO-U79OL

yakuza.ppc.elf New Fork (PID: 6290, Parent: 6236)

sh (PID: 6290, Parent: 6236, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 JuYfouyf87 || busybox pkill -9 JuYfouyf87"

sh New Fork (PID: 6295, Parent: 6290)

pkill (PID: 6295, Parent: 6290, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 JuYfouyf87

sh New Fork (PID: 6296, Parent: 6290)

busybox (PID: 6296, Parent: 6290, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 JuYfouyf87

yakuza.ppc.elf New Fork (PID: 6299, Parent: 6236)

sh (PID: 6299, Parent: 6236, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 NiGGeR69xd || busybox pkill -9 NiGGeR69xd"

sh New Fork (PID: 6304, Parent: 6299)

pkill (PID: 6304, Parent: 6299, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 NiGGeR69xd

sh New Fork (PID: 6305, Parent: 6299)

busybox (PID: 6305, Parent: 6299, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 NiGGeR69xd

yakuza.ppc.elf New Fork (PID: 6307, Parent: 6236)

sh (PID: 6307, Parent: 6236, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 SO190Ij1X || busybox pkill -9 SO190Ij1X"

sh New Fork (PID: 6312, Parent: 6307)

pkill (PID: 6312, Parent: 6307, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 SO190Ij1X

sh New Fork (PID: 6313, Parent: 6307)

busybox (PID: 6313, Parent: 6307, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 SO190Ij1X

yakuza.ppc.elf New Fork (PID: 6314, Parent: 6236)

sh (PID: 6314, Parent: 6236, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 LOLKIKEEEDDE || busybox pkill -9 LOLKIKEEEDDE"

sh New Fork (PID: 6320, Parent: 6314)

pkill (PID: 6320, Parent: 6314, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 LOLKIKEEEDDE

sh New Fork (PID: 6323, Parent: 6314)

busybox (PID: 6323, Parent: 6314, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 LOLKIKEEEDDE

yakuza.ppc.elf New Fork (PID: 6324, Parent: 6236)

sh (PID: 6324, Parent: 6236, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 ekjheory98e || busybox pkill -9 ekjheory98e"

sh New Fork (PID: 6329, Parent: 6324)

pkill (PID: 6329, Parent: 6324, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 ekjheory98e

sh New Fork (PID: 6330, Parent: 6324)

busybox (PID: 6330, Parent: 6324, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 ekjheory98e

yakuza.ppc.elf New Fork (PID: 6331, Parent: 6236)

sh (PID: 6331, Parent: 6236, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 scansh4 || busybox pkill -9 scansh4"

sh New Fork (PID: 6333, Parent: 6331)

pkill (PID: 6333, Parent: 6331, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 scansh4

sh New Fork (PID: 6353, Parent: 6331)

busybox (PID: 6353, Parent: 6331, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 scansh4

yakuza.ppc.elf New Fork (PID: 6356, Parent: 6236)

sh (PID: 6356, Parent: 6236, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 MDMA || busybox pkill -9 MDMA"

sh New Fork (PID: 6358, Parent: 6356)

pkill (PID: 6358, Parent: 6356, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 MDMA

sh New Fork (PID: 6359, Parent: 6356)

busybox (PID: 6359, Parent: 6356, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 MDMA

yakuza.ppc.elf New Fork (PID: 6360, Parent: 6236)

sh (PID: 6360, Parent: 6236, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 fdevalvex || busybox pkill -9 fdevalvex"

sh New Fork (PID: 6362, Parent: 6360)

pkill (PID: 6362, Parent: 6360, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 fdevalvex

sh New Fork (PID: 6363, Parent: 6360)

busybox (PID: 6363, Parent: 6360, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 fdevalvex

yakuza.ppc.elf New Fork (PID: 6364, Parent: 6236)

sh (PID: 6364, Parent: 6236, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 scanspc || busybox pkill -9 scanspc"

sh New Fork (PID: 6366, Parent: 6364)

pkill (PID: 6366, Parent: 6364, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 scanspc

sh New Fork (PID: 6369, Parent: 6364)

busybox (PID: 6369, Parent: 6364, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 scanspc

yakuza.ppc.elf New Fork (PID: 6370, Parent: 6236)

sh (PID: 6370, Parent: 6236, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 MELTEDNINJAREALZ || busybox pkill -9 MELTEDNINJAREALZ"

sh New Fork (PID: 6375, Parent: 6370)

pkill (PID: 6375, Parent: 6370, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 MELTEDNINJAREALZ

sh New Fork (PID: 6376, Parent: 6370)

busybox (PID: 6376, Parent: 6370, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 MELTEDNINJAREALZ

yakuza.ppc.elf New Fork (PID: 6377, Parent: 6236)

sh (PID: 6377, Parent: 6236, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 flexsonskids || busybox pkill -9 flexsonskids"

sh New Fork (PID: 6379, Parent: 6377)

pkill (PID: 6379, Parent: 6377, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 flexsonskids

sh New Fork (PID: 6382, Parent: 6377)

busybox (PID: 6382, Parent: 6377, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 flexsonskids

yakuza.ppc.elf New Fork (PID: 6383, Parent: 6236)

sh (PID: 6383, Parent: 6236, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 scanx86 || busybox pkill -9 scanx86"

sh New Fork (PID: 6385, Parent: 6383)

pkill (PID: 6385, Parent: 6383, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 scanx86

sh New Fork (PID: 6386, Parent: 6383)

busybox (PID: 6386, Parent: 6383, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 scanx86

yakuza.ppc.elf New Fork (PID: 6387, Parent: 6236)

sh (PID: 6387, Parent: 6236, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 MISAKI-U79OL || busybox pkill -9 MISAKI-U79OL"

sh New Fork (PID: 6389, Parent: 6387)

pkill (PID: 6389, Parent: 6387, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 MISAKI-U79OL

sh New Fork (PID: 6390, Parent: 6387)

busybox (PID: 6390, Parent: 6387, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 MISAKI-U79OL

yakuza.ppc.elf New Fork (PID: 6391, Parent: 6236)

sh (PID: 6391, Parent: 6236, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 foAxi102kxe || busybox pkill -9 foAxi102kxe"

sh New Fork (PID: 6397, Parent: 6391)

pkill (PID: 6397, Parent: 6391, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 foAxi102kxe

sh New Fork (PID: 6400, Parent: 6391)

busybox (PID: 6400, Parent: 6391, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 foAxi102kxe

yakuza.ppc.elf New Fork (PID: 6401, Parent: 6236)

sh (PID: 6401, Parent: 6236, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 swodjwodjwoj || busybox pkill -9 swodjwodjwoj"

sh New Fork (PID: 6406, Parent: 6401)

pkill (PID: 6406, Parent: 6401, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 swodjwodjwoj

sh New Fork (PID: 6407, Parent: 6401)

busybox (PID: 6407, Parent: 6401, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 swodjwodjwoj

yakuza.ppc.elf New Fork (PID: 6408, Parent: 6236)

sh (PID: 6408, Parent: 6236, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 MmKiy7f87l || busybox pkill -9 MmKiy7f87l"

sh New Fork (PID: 6413, Parent: 6408)

pkill (PID: 6413, Parent: 6408, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 MmKiy7f87l

sh New Fork (PID: 6414, Parent: 6408)

busybox (PID: 6414, Parent: 6408, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 MmKiy7f87l

yakuza.ppc.elf New Fork (PID: 6417, Parent: 6236)

sh (PID: 6417, Parent: 6236, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 freecookiex86 || busybox pkill -9 freecookiex86"

sh New Fork (PID: 6422, Parent: 6417)

pkill (PID: 6422, Parent: 6417, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 freecookiex86

sh New Fork (PID: 6423, Parent: 6417)

busybox (PID: 6423, Parent: 6417, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 freecookiex86

yakuza.ppc.elf New Fork (PID: 6425, Parent: 6236)

sh (PID: 6425, Parent: 6236, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 sysgpu || busybox pkill -9 sysgpu"

sh New Fork (PID: 6431, Parent: 6425)

pkill (PID: 6431, Parent: 6425, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 sysgpu

sh New Fork (PID: 6432, Parent: 6425)

busybox (PID: 6432, Parent: 6425, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 sysgpu

yakuza.ppc.elf New Fork (PID: 6433, Parent: 6236)

sh (PID: 6433, Parent: 6236, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 NiGGeR69xd || busybox pkill -9 NiGGeR69xd"

sh New Fork (PID: 6438, Parent: 6433)

pkill (PID: 6438, Parent: 6433, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 NiGGeR69xd

sh New Fork (PID: 6441, Parent: 6433)

busybox (PID: 6441, Parent: 6433, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 NiGGeR69xd

yakuza.ppc.elf New Fork (PID: 6442, Parent: 6236)

sh (PID: 6442, Parent: 6236, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 frgege || busybox pkill -9 frgege"

sh New Fork (PID: 6447, Parent: 6442)

pkill (PID: 6447, Parent: 6442, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 frgege

sh New Fork (PID: 6448, Parent: 6442)

busybox (PID: 6448, Parent: 6442, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 frgege

yakuza.ppc.elf New Fork (PID: 6449, Parent: 6236)

sh (PID: 6449, Parent: 6236, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 sysupdater || busybox pkill -9 sysupdater"

sh New Fork (PID: 6454, Parent: 6449)

pkill (PID: 6454, Parent: 6449, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 sysupdater

sh New Fork (PID: 6457, Parent: 6449)

busybox (PID: 6457, Parent: 6449, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 sysupdater

yakuza.ppc.elf New Fork (PID: 6460, Parent: 6236)

sh (PID: 6460, Parent: 6236, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 0DnAzepd || busybox pkill -9 0DnAzepd"

sh New Fork (PID: 6464, Parent: 6460)

pkill (PID: 6464, Parent: 6460, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 0DnAzepd

sh New Fork (PID: 6466, Parent: 6460)

busybox (PID: 6466, Parent: 6460, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 0DnAzepd

yakuza.ppc.elf New Fork (PID: 6467, Parent: 6236)

sh (PID: 6467, Parent: 6236, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 NiGGeRD0nks69 || busybox pkill -9 NiGGeRD0nks69"

sh New Fork (PID: 6472, Parent: 6467)

pkill (PID: 6472, Parent: 6467, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 NiGGeRD0nks69

sh New Fork (PID: 6473, Parent: 6467)

busybox (PID: 6473, Parent: 6467, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 NiGGeRD0nks69

yakuza.ppc.elf New Fork (PID: 6474, Parent: 6236)

sh (PID: 6474, Parent: 6236, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 frgreu || busybox pkill -9 frgreu"

sh New Fork (PID: 6479, Parent: 6474)

pkill (PID: 6479, Parent: 6474, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 frgreu

sh New Fork (PID: 6482, Parent: 6474)

busybox (PID: 6482, Parent: 6474, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 frgreu

yakuza.ppc.elf New Fork (PID: 6483, Parent: 6236)

sh (PID: 6483, Parent: 6236, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 telnetd || busybox pkill -9 telnetd"

sh New Fork (PID: 6488, Parent: 6483)

pkill (PID: 6488, Parent: 6483, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 telnetd

sh New Fork (PID: 6489, Parent: 6483)

busybox (PID: 6489, Parent: 6483, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 telnetd

yakuza.ppc.elf New Fork (PID: 6490, Parent: 6236)

sh (PID: 6490, Parent: 6236, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 0x766f6964 || busybox pkill -9 0x766f6964"

sh New Fork (PID: 6496, Parent: 6490)

pkill (PID: 6496, Parent: 6490, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 0x766f6964

sh New Fork (PID: 6499, Parent: 6490)

busybox (PID: 6499, Parent: 6490, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 0x766f6964

yakuza.ppc.elf New Fork (PID: 6500, Parent: 6236)

sh (PID: 6500, Parent: 6236, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 NiGGeRd0nks1337 || busybox pkill -9 NiGGeRd0nks1337"

sh New Fork (PID: 6505, Parent: 6500)

pkill (PID: 6505, Parent: 6500, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 NiGGeRd0nks1337

sh New Fork (PID: 6506, Parent: 6500)

busybox (PID: 6506, Parent: 6500, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 NiGGeRd0nks1337

yakuza.ppc.elf New Fork (PID: 6507, Parent: 6236)

sh (PID: 6507, Parent: 6236, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 gaft || busybox pkill -9 gaft"

sh New Fork (PID: 6512, Parent: 6507)

pkill (PID: 6512, Parent: 6507, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 gaft

sh New Fork (PID: 6513, Parent: 6507)

busybox (PID: 6513, Parent: 6507, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 gaft

yakuza.ppc.elf New Fork (PID: 6516, Parent: 6236)

sh (PID: 6516, Parent: 6236, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 urasgbsigboa || busybox pkill -9 urasgbsigboa"

sh New Fork (PID: 6521, Parent: 6516)

pkill (PID: 6521, Parent: 6516, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 urasgbsigboa

sh New Fork (PID: 6522, Parent: 6516)

busybox (PID: 6522, Parent: 6516, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 urasgbsigboa

yakuza.ppc.elf New Fork (PID: 6523, Parent: 6236)

sh (PID: 6523, Parent: 6236, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 120i3UI49 || busybox pkill -9 120i3UI49"

sh New Fork (PID: 6528, Parent: 6523)

pkill (PID: 6528, Parent: 6523, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 120i3UI49

sh New Fork (PID: 6529, Parent: 6523)

busybox (PID: 6529, Parent: 6523, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 120i3UI49

yakuza.ppc.elf New Fork (PID: 6530, Parent: 6236)

sh (PID: 6530, Parent: 6236, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 OaF3 || busybox pkill -9 OaF3"

sh New Fork (PID: 6535, Parent: 6530)

pkill (PID: 6535, Parent: 6530, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 OaF3

sh New Fork (PID: 6538, Parent: 6530)

busybox (PID: 6538, Parent: 6530, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 OaF3

yakuza.ppc.elf New Fork (PID: 6539, Parent: 6236)

sh (PID: 6539, Parent: 6236, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 geae || busybox pkill -9 geae"

sh New Fork (PID: 6544, Parent: 6539)

pkill (PID: 6544, Parent: 6539, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 geae

sh New Fork (PID: 6546, Parent: 6539)

busybox (PID: 6546, Parent: 6539, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 geae

yakuza.ppc.elf New Fork (PID: 6547, Parent: 6236)

sh (PID: 6547, Parent: 6236, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 vaiolmao || busybox pkill -9 vaiolmao"

sh New Fork (PID: 6553, Parent: 6547)

pkill (PID: 6553, Parent: 6547, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 vaiolmao

sh New Fork (PID: 6554, Parent: 6547)

busybox (PID: 6554, Parent: 6547, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 vaiolmao

yakuza.ppc.elf New Fork (PID: 6557, Parent: 6236)

sh (PID: 6557, Parent: 6236, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 123123a || busybox pkill -9 123123a"

sh New Fork (PID: 6562, Parent: 6557)

pkill (PID: 6562, Parent: 6557, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 123123a

sh New Fork (PID: 6563, Parent: 6557)

busybox (PID: 6563, Parent: 6557, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 123123a

yakuza.ppc.elf New Fork (PID: 6564, Parent: 6236)

sh (PID: 6564, Parent: 6236, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 Ofurain0n4H34D || busybox pkill -9 Ofurain0n4H34D"

sh New Fork (PID: 6569, Parent: 6564)

pkill (PID: 6569, Parent: 6564, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 Ofurain0n4H34D

sh New Fork (PID: 6570, Parent: 6564)

busybox (PID: 6570, Parent: 6564, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 Ofurain0n4H34D

yakuza.ppc.elf New Fork (PID: 6571, Parent: 6236)

sh (PID: 6571, Parent: 6236, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 ggTrex || busybox pkill -9 ggTrex"

sh New Fork (PID: 6576, Parent: 6571)

pkill (PID: 6576, Parent: 6571, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 ggTrex

sh New Fork (PID: 6579, Parent: 6571)

busybox (PID: 6579, Parent: 6571, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 ggTrex

yakuza.ppc.elf New Fork (PID: 6580, Parent: 6236)

sh (PID: 6580, Parent: 6236, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 wasads || busybox pkill -9 wasads"

sh New Fork (PID: 6585, Parent: 6580)

pkill (PID: 6585, Parent: 6580, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 wasads

sh New Fork (PID: 6586, Parent: 6580)

busybox (PID: 6586, Parent: 6580, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 wasads

yakuza.ppc.elf New Fork (PID: 6587, Parent: 6236)

sh (PID: 6587, Parent: 6236, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 1293194hjXD || busybox pkill -9 1293194hjXD"

sh New Fork (PID: 6592, Parent: 6587)

pkill (PID: 6592, Parent: 6587, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 1293194hjXD

sh New Fork (PID: 6593, Parent: 6587)

busybox (PID: 6593, Parent: 6587, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 1293194hjXD

yakuza.ppc.elf New Fork (PID: 6596, Parent: 6236)

sh (PID: 6596, Parent: 6236, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 OthLaLosn || busybox pkill -9 OthLaLosn"

sh New Fork (PID: 6598, Parent: 6596)

pkill (PID: 6598, Parent: 6596, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 OthLaLosn

sh New Fork (PID: 6599, Parent: 6596)

busybox (PID: 6599, Parent: 6596, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 OthLaLosn

yakuza.ppc.elf New Fork (PID: 6600, Parent: 6236)

sh (PID: 6600, Parent: 6236, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 ggt || busybox pkill -9 ggt"

sh New Fork (PID: 6602, Parent: 6600)

pkill (PID: 6602, Parent: 6600, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 ggt

sh New Fork (PID: 6603, Parent: 6600)

busybox (PID: 6603, Parent: 6600, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 ggt

yakuza.ppc.elf New Fork (PID: 6606, Parent: 6236)

sh (PID: 6606, Parent: 6236, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 wget-log || busybox pkill -9 wget-log"

sh New Fork (PID: 6612, Parent: 6606)

pkill (PID: 6612, Parent: 6606, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 wget-log

sh New Fork (PID: 6613, Parent: 6606)

busybox (PID: 6613, Parent: 6606, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 wget-log

yakuza.ppc.elf New Fork (PID: 6614, Parent: 6236)

sh (PID: 6614, Parent: 6236, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 1337SoraLOADER || busybox pkill -9 1337SoraLOADER"

sh New Fork (PID: 6619, Parent: 6614)

pkill (PID: 6619, Parent: 6614, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 1337SoraLOADER

sh New Fork (PID: 6620, Parent: 6614)

busybox (PID: 6620, Parent: 6614, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 1337SoraLOADER

yakuza.ppc.elf New Fork (PID: 6621, Parent: 6236)

sh (PID: 6621, Parent: 6236, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 SAIAKINA || busybox pkill -9 SAIAKINA"

sh New Fork (PID: 6626, Parent: 6621)

pkill (PID: 6626, Parent: 6621, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 SAIAKINA

sh New Fork (PID: 6627, Parent: 6621)

busybox (PID: 6627, Parent: 6621, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 SAIAKINA

yakuza.ppc.elf New Fork (PID: 6630, Parent: 6236)

sh (PID: 6630, Parent: 6236, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 ggtq || busybox pkill -9 ggtq"

sh New Fork (PID: 6635, Parent: 6630)

pkill (PID: 6635, Parent: 6630, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 ggtq

sh New Fork (PID: 6637, Parent: 6630)

busybox (PID: 6637, Parent: 6630, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 ggtq

yakuza.ppc.elf New Fork (PID: 6638, Parent: 6236)

sh (PID: 6638, Parent: 6236, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 1378bfp919GRB1Q2 || busybox pkill -9 1378bfp919GRB1Q2"

sh New Fork (PID: 6643, Parent: 6638)

pkill (PID: 6643, Parent: 6638, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 1378bfp919GRB1Q2

sh New Fork (PID: 6644, Parent: 6638)

busybox (PID: 6644, Parent: 6638, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 1378bfp919GRB1Q2

yakuza.ppc.elf New Fork (PID: 6645, Parent: 6236)

sh (PID: 6645, Parent: 6236, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 SAIAKUSO || busybox pkill -9 SAIAKUSO"

sh New Fork (PID: 6650, Parent: 6645)

pkill (PID: 6650, Parent: 6645, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 SAIAKUSO

sh New Fork (PID: 6653, Parent: 6645)

busybox (PID: 6653, Parent: 6645, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 SAIAKUSO

yakuza.ppc.elf New Fork (PID: 6654, Parent: 6236)

sh (PID: 6654, Parent: 6236, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 ggtr || busybox pkill -9 ggtr"

sh New Fork (PID: 6658, Parent: 6654)

pkill (PID: 6658, Parent: 6654, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 ggtr

sh New Fork (PID: 6661, Parent: 6654)

busybox (PID: 6661, Parent: 6654, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 ggtr

yakuza.ppc.elf New Fork (PID: 6662, Parent: 6236)

sh (PID: 6662, Parent: 6236, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 14Fa || busybox pkill -9 14Fa"

sh New Fork (PID: 6668, Parent: 6662)

pkill (PID: 6668, Parent: 6662, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 14Fa

sh New Fork (PID: 6671, Parent: 6662)

busybox (PID: 6671, Parent: 6662, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 14Fa

yakuza.ppc.elf New Fork (PID: 6672, Parent: 6236)

sh (PID: 6672, Parent: 6236, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 SEXSLAVE1337 || busybox pkill -9 SEXSLAVE1337"

sh New Fork (PID: 6674, Parent: 6672)

pkill (PID: 6674, Parent: 6672, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 SEXSLAVE1337

sh New Fork (PID: 6675, Parent: 6672)

busybox (PID: 6675, Parent: 6672, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 SEXSLAVE1337

yakuza.ppc.elf New Fork (PID: 6676, Parent: 6236)

sh (PID: 6676, Parent: 6236, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 ggtt || busybox pkill -9 ggtt"

sh New Fork (PID: 6678, Parent: 6676)

pkill (PID: 6678, Parent: 6676, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 ggtt

sh New Fork (PID: 6681, Parent: 6676)

busybox (PID: 6681, Parent: 6676, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 ggtt

yakuza.ppc.elf New Fork (PID: 6684, Parent: 6236)

sh (PID: 6684, Parent: 6236, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 1902a3u912u3u4 || busybox pkill -9 1902a3u912u3u4"

sh New Fork (PID: 6686, Parent: 6684)

pkill (PID: 6686, Parent: 6684, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 1902a3u912u3u4

sh New Fork (PID: 6687, Parent: 6684)

busybox (PID: 6687, Parent: 6684, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 1902a3u912u3u4

yakuza.ppc.elf New Fork (PID: 6688, Parent: 6236)

sh (PID: 6688, Parent: 6236, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 SO190Ij1X || busybox pkill -9 SO190Ij1X"

sh New Fork (PID: 6693, Parent: 6688)

pkill (PID: 6693, Parent: 6688, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 SO190Ij1X

sh New Fork (PID: 6694, Parent: 6688)

busybox (PID: 6694, Parent: 6688, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 SO190Ij1X

yakuza.ppc.elf New Fork (PID: 6695, Parent: 6236)

sh (PID: 6695, Parent: 6236, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 haetrghbr || busybox pkill -9 haetrghbr"

sh New Fork (PID: 6697, Parent: 6695)

pkill (PID: 6697, Parent: 6695, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 haetrghbr

sh New Fork (PID: 6700, Parent: 6695)

busybox (PID: 6700, Parent: 6695, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 haetrghbr

yakuza.ppc.elf New Fork (PID: 6701, Parent: 6236)

sh (PID: 6701, Parent: 6236, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 19ju3d || busybox pkill -9 19ju3d"

sh New Fork (PID: 6706, Parent: 6701)

pkill (PID: 6706, Parent: 6701, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 19ju3d

sh New Fork (PID: 6707, Parent: 6701)

busybox (PID: 6707, Parent: 6701, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 19ju3d

yakuza.ppc.elf New Fork (PID: 6708, Parent: 6236)

sh (PID: 6708, Parent: 6236, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 SORAojkf120 || busybox pkill -9 SORAojkf120"

sh New Fork (PID: 6710, Parent: 6708)

pkill (PID: 6710, Parent: 6708, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 SORAojkf120

sh New Fork (PID: 6711, Parent: 6708)

busybox (PID: 6711, Parent: 6708, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 SORAojkf120

yakuza.ppc.elf New Fork (PID: 6714, Parent: 6236)

sh (PID: 6714, Parent: 6236, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 hehahejeje92 || busybox pkill -9 hehahejeje92"

sh New Fork (PID: 6716, Parent: 6714)

pkill (PID: 6716, Parent: 6714, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 hehahejeje92

sh New Fork (PID: 6717, Parent: 6714)

busybox (PID: 6717, Parent: 6714, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 hehahejeje92

yakuza.ppc.elf New Fork (PID: 6718, Parent: 6236)

sh (PID: 6718, Parent: 6236, MD5: 1e6b1c887c59a315edb7eb9a315fc84c) Arguments: sh -c "pkill -9 2U2JDJA901F91 || busybox pkill -9 2U2JDJA901F91"

sh New Fork (PID: 6724, Parent: 6718)

pkill (PID: 6724, Parent: 6718, MD5: fa96a75a08109d8842e4865b2907d51f) Arguments: pkill -9 2U2JDJA901F91

sh New Fork (PID: 6725, Parent: 6718)

busybox (PID: 6725, Parent: 6718, MD5: 70584dffe9cb0309eb22ba78aa54bcdc) Arguments: busybox pkill -9 2U2JDJA901F91

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Mirai	Mirai is one of the first significant botnets targeting exposed networking devices running Linux. Found in August 2016 by MalwareMustDie, its name means "future" in Japanese. Nowadays it targets a wide range of networked embedded devices such as IP cameras, home routers (many vendors involved), and other IoT devices. Since the source code was published on "Hack Forums" many variants of the Mirai family appeared, infecting mostly home networks all around the world.	No Attribution	http://osint.bambenekconsulting.com/feeds/ http://www.simonroses.com/2016/10/mirai-ddos-botnet-source-code-binary-analysis/ https://blog.malwaremustdie.org/2020/02/mmd-0065-2021-linuxmirai-fbot-re.html https://blog.netlab.360.com/another-lilin-dvr-0-day-being-used-to-spread-mirai-en/ https://blog.netlab.360.com/mirai_ptea-botnet-is-exploiting-undisclosed-kguard-dvr-vulnerability-en/	https://malpedia.caad.fkie.fraunhofer.de/details/elf.mirai

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
yakuza.ppc.elf	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
yakuza.ppc.elf	Linux_Trojan_Tsunami_8a11f9be	unknown	unknown	0x17fa1:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20 0x18659:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20

Memory Dumps

Source	Rule	Description	Author	Strings
6234.1.00007f88b0001000.00007f88b001c000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6234.1.00007f88b0001000.00007f88b001c000.r-x.sdmp	Linux_Trojan_Tsunami_8a11f9be	unknown	unknown	0x17fa1:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20 0x18659:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20
6243.1.00007f88b0001000.00007f88b001c000.r-x.sdmp	JoeSecurity_Mirai_8	Yara detected Mirai	Joe Security
6243.1.00007f88b0001000.00007f88b001c000.r-x.sdmp	Linux_Trojan_Tsunami_8a11f9be	unknown	unknown	0x17fa1:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20 0x18659:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20
Process Memory Space: yakuza.ppc.elf PID: 6234	Linux_Trojan_Tsunami_8a11f9be	unknown	unknown	0xc815:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20 0xc926:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20 0xcf69:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20
Process Memory Space: yakuza.ppc.elf PID: 6243	Linux_Trojan_Tsunami_8a11f9be	unknown	unknown	0x10445:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20 0x10556:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20 0x10b99:$a: 3E 20 3C 70 6F 72 74 3E 20 3C 72 65 66 6C 65 63 74 69 6F 6E 20
Click to see the 1 entries

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: yakuza.ppc.elf

ReversingLabs: Detection: 55%

Source: /usr/bin/pkill (PID: 6251)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6272)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6282)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6288)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6295)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6304)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6312)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6320)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6329)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6333)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6358)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6362)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6366)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6375)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6379)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6385)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6389)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6397)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6406)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6413)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6422)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6431)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6438)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6447)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6454)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6464)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6472)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6479)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6488)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6496)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6505)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6512)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6521)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6528)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6535)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6544)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6553)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6562)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6569)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6576)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6585)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6592)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6598)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6602)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6612)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6619)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6626)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6635)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6643)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6650)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6658)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6668)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6674)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6678)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6686)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6693)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6697)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6706)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6710)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6716)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6724)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Source: /tmp/yakuza.ppc.elf (PID: 6243)

Reads hosts file: /etc/hosts

Jump to behavior

Source: global traffic	TCP traffic: 192.168.2.23:43928 -> 91.189.91.42:443
Source: global traffic	TCP traffic: 192.168.2.23:42836 -> 91.189.91.43:443
Source: global traffic	TCP traffic: 192.168.2.23:42516 -> 109.202.202.202:80

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

DNS traffic detected: DNS query: pirati.privatedns.org

Source: yakuza.ppc.elf	String found in binary or memory: http://linux-it.abuser.eu/yak.sh;
Source: yakuza.ppc.elf	String found in binary or memory: https://youtu.be/dQw4w9WgXcQ
Source: yakuza.ppc.elf	String found in binary or memory: https://youtu.be/dQw4w9WgXcQNever

Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443

System Summary

Malicious sample detected (through community Yara rule)

Source: yakuza.ppc.elf, type: SAMPLE	Matched rule: Linux_Trojan_Tsunami_8a11f9be Author: unknown
Source: 6234.1.00007f88b0001000.00007f88b001c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_8a11f9be Author: unknown
Source: 6243.1.00007f88b0001000.00007f88b001c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_8a11f9be Author: unknown
Source: Process Memory Space: yakuza.ppc.elf PID: 6234, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_8a11f9be Author: unknown
Source: Process Memory Space: yakuza.ppc.elf PID: 6243, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_8a11f9be Author: unknown

Source: yakuza.ppc.elf	ELF static info symbol of initial sample: passwords
Source: yakuza.ppc.elf	ELF static info symbol of initial sample: usernames

Source: Initial sample	String containing 'busybox' found: busybox
Source: Initial sample	String containing 'busybox' found: pkill -9 %s \|\| busybox pkill -9 %s
Source: Initial sample	String containing 'busybox' found: pkill -9 %s \|\| busybox pkill -9 %shistory -c;history -wcd /root;rm -f .bash_historycd /var/tmp; rm -f *NOTICE %s :MOVE <server>

Source: Initial sample	String containing potential weak password found: guest
Source: Initial sample	String containing potential weak password found: default
Source: Initial sample	String containing potential weak password found: admin
Source: Initial sample	String containing potential weak password found: supervisor
Source: Initial sample	String containing potential weak password found: service
Source: Initial sample	String containing potential weak password found: administrator
Source: Initial sample	String containing potential weak password found: support
Source: Initial sample	String containing potential weak password found: 123456
Source: Initial sample	String containing potential weak password found: password
Source: Initial sample	String containing potential weak password found: 12345

Source: yakuza.ppc.elf, type: SAMPLE	Matched rule: Linux_Trojan_Tsunami_8a11f9be reference_sample = 1f773d0e00d40eecde9e3ab80438698923a2620036c2fc33315ef95229e98571, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = 91e2572a3bb8583e20042578e95e1746501c6a71ef7635af2c982a05b18d7c6d, id = 8a11f9be-dc85-4695-9f38-80ca0304780e, last_modified = 2021-09-16
Source: 6234.1.00007f88b0001000.00007f88b001c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_8a11f9be reference_sample = 1f773d0e00d40eecde9e3ab80438698923a2620036c2fc33315ef95229e98571, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = 91e2572a3bb8583e20042578e95e1746501c6a71ef7635af2c982a05b18d7c6d, id = 8a11f9be-dc85-4695-9f38-80ca0304780e, last_modified = 2021-09-16
Source: 6243.1.00007f88b0001000.00007f88b001c000.r-x.sdmp, type: MEMORY	Matched rule: Linux_Trojan_Tsunami_8a11f9be reference_sample = 1f773d0e00d40eecde9e3ab80438698923a2620036c2fc33315ef95229e98571, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = 91e2572a3bb8583e20042578e95e1746501c6a71ef7635af2c982a05b18d7c6d, id = 8a11f9be-dc85-4695-9f38-80ca0304780e, last_modified = 2021-09-16
Source: Process Memory Space: yakuza.ppc.elf PID: 6234, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_8a11f9be reference_sample = 1f773d0e00d40eecde9e3ab80438698923a2620036c2fc33315ef95229e98571, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = 91e2572a3bb8583e20042578e95e1746501c6a71ef7635af2c982a05b18d7c6d, id = 8a11f9be-dc85-4695-9f38-80ca0304780e, last_modified = 2021-09-16
Source: Process Memory Space: yakuza.ppc.elf PID: 6243, type: MEMORYSTR	Matched rule: Linux_Trojan_Tsunami_8a11f9be reference_sample = 1f773d0e00d40eecde9e3ab80438698923a2620036c2fc33315ef95229e98571, os = linux, severity = x86, creation_date = 2021-01-12, scan_context = file, memory, license = Elastic License v2, threat_name = Linux.Trojan.Tsunami, fingerprint = 91e2572a3bb8583e20042578e95e1746501c6a71ef7635af2c982a05b18d7c6d, id = 8a11f9be-dc85-4695-9f38-80ca0304780e, last_modified = 2021-09-16

Source: classification engine

Classification label: mal64.troj.linELF@0/0@1/0

Source: yakuza.ppc.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/powerpc/brk.S
Source: yakuza.ppc.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/powerpc/crt1.S
Source: yakuza.ppc.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/powerpc/crti.S
Source: yakuza.ppc.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/powerpc/crtn.S
Source: yakuza.ppc.elf	ELF static info symbol of initial sample: libc/sysdeps/linux/powerpc/vfork.S

Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/6472/status
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/6472/cmdline
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/6236/status
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/6236/cmdline
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/1582/status
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/1582/cmdline
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/3088/status
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/3088/cmdline
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/230/status
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/230/cmdline
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/110/status
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/110/cmdline
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/231/status
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/231/cmdline
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/111/status
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/111/cmdline
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/232/status
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/232/cmdline
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/1579/status
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/1579/cmdline
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/112/status
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/112/cmdline
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/233/status
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/233/cmdline
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/1699/status
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/1699/cmdline
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/113/status
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/113/cmdline
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/234/status
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/234/cmdline
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/1335/status
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/1335/cmdline
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/1698/status
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/1698/cmdline
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/114/status
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/114/cmdline
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/235/status
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/235/cmdline
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/1334/status
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/1334/cmdline
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/1576/status
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/1576/cmdline
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/2302/status
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/2302/cmdline
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/115/status
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/115/cmdline
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/236/status
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/236/cmdline
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/116/status
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/116/cmdline
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/237/status
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/237/cmdline
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/117/status
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/117/cmdline
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/118/status
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/118/cmdline
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/910/status
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/910/cmdline
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/119/status
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/119/cmdline
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/912/status
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/912/cmdline
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/10/status
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/10/cmdline
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/2307/status
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/2307/cmdline
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/11/status
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/11/cmdline
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/918/status
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/918/cmdline
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/12/status
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/12/cmdline
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/13/status
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/13/cmdline
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/6243/status
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/6243/cmdline
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/14/status
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/14/cmdline
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/6242/status
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/6242/cmdline
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/15/status
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/15/cmdline
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/16/status
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/16/cmdline
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/17/status
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/17/cmdline
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/18/status
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/18/cmdline
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/1594/status
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/1594/cmdline
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/120/status
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/120/cmdline
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/121/status
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/121/cmdline
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/1349/status
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/1349/cmdline
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/1/status
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/1/cmdline
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/122/status
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/122/cmdline
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/243/status
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/243/cmdline
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/123/status
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/123/cmdline
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/2/status
Source: /usr/bin/pkill (PID: 6472)	File opened: /proc/2/cmdline

Source: /tmp/yakuza.ppc.elf (PID: 6246)	Shell command executed: sh -c "pkill -9 902i13 \|\| busybox pkill -9 902i13"	Jump to behavior
Source: /tmp/yakuza.ppc.elf (PID: 6267)	Shell command executed: sh -c "pkill -9 BzSxLxBxeY \|\| busybox pkill -9 BzSxLxBxeY"	Jump to behavior
Source: /tmp/yakuza.ppc.elf (PID: 6280)	Shell command executed: sh -c "pkill -9 HOHO-LUGO7 \|\| busybox pkill -9 HOHO-LUGO7"	Jump to behavior
Source: /tmp/yakuza.ppc.elf (PID: 6286)	Shell command executed: sh -c "pkill -9 HOHO-U79OL \|\| busybox pkill -9 HOHO-U79OL"	Jump to behavior
Source: /tmp/yakuza.ppc.elf (PID: 6290)	Shell command executed: sh -c "pkill -9 JuYfouyf87 \|\| busybox pkill -9 JuYfouyf87"	Jump to behavior
Source: /tmp/yakuza.ppc.elf (PID: 6299)	Shell command executed: sh -c "pkill -9 NiGGeR69xd \|\| busybox pkill -9 NiGGeR69xd"	Jump to behavior
Source: /tmp/yakuza.ppc.elf (PID: 6307)	Shell command executed: sh -c "pkill -9 SO190Ij1X \|\| busybox pkill -9 SO190Ij1X"	Jump to behavior
Source: /tmp/yakuza.ppc.elf (PID: 6314)	Shell command executed: sh -c "pkill -9 LOLKIKEEEDDE \|\| busybox pkill -9 LOLKIKEEEDDE"	Jump to behavior
Source: /tmp/yakuza.ppc.elf (PID: 6324)	Shell command executed: sh -c "pkill -9 ekjheory98e \|\| busybox pkill -9 ekjheory98e"	Jump to behavior
Source: /tmp/yakuza.ppc.elf (PID: 6331)	Shell command executed: sh -c "pkill -9 scansh4 \|\| busybox pkill -9 scansh4"	Jump to behavior
Source: /tmp/yakuza.ppc.elf (PID: 6356)	Shell command executed: sh -c "pkill -9 MDMA \|\| busybox pkill -9 MDMA"	Jump to behavior
Source: /tmp/yakuza.ppc.elf (PID: 6360)	Shell command executed: sh -c "pkill -9 fdevalvex \|\| busybox pkill -9 fdevalvex"	Jump to behavior
Source: /tmp/yakuza.ppc.elf (PID: 6364)	Shell command executed: sh -c "pkill -9 scanspc \|\| busybox pkill -9 scanspc"	Jump to behavior
Source: /tmp/yakuza.ppc.elf (PID: 6370)	Shell command executed: sh -c "pkill -9 MELTEDNINJAREALZ \|\| busybox pkill -9 MELTEDNINJAREALZ"	Jump to behavior
Source: /tmp/yakuza.ppc.elf (PID: 6377)	Shell command executed: sh -c "pkill -9 flexsonskids \|\| busybox pkill -9 flexsonskids"	Jump to behavior
Source: /tmp/yakuza.ppc.elf (PID: 6383)	Shell command executed: sh -c "pkill -9 scanx86 \|\| busybox pkill -9 scanx86"	Jump to behavior
Source: /tmp/yakuza.ppc.elf (PID: 6387)	Shell command executed: sh -c "pkill -9 MISAKI-U79OL \|\| busybox pkill -9 MISAKI-U79OL"
Source: /tmp/yakuza.ppc.elf (PID: 6391)	Shell command executed: sh -c "pkill -9 foAxi102kxe \|\| busybox pkill -9 foAxi102kxe"
Source: /tmp/yakuza.ppc.elf (PID: 6401)	Shell command executed: sh -c "pkill -9 swodjwodjwoj \|\| busybox pkill -9 swodjwodjwoj"
Source: /tmp/yakuza.ppc.elf (PID: 6408)	Shell command executed: sh -c "pkill -9 MmKiy7f87l \|\| busybox pkill -9 MmKiy7f87l"
Source: /tmp/yakuza.ppc.elf (PID: 6417)	Shell command executed: sh -c "pkill -9 freecookiex86 \|\| busybox pkill -9 freecookiex86"
Source: /tmp/yakuza.ppc.elf (PID: 6425)	Shell command executed: sh -c "pkill -9 sysgpu \|\| busybox pkill -9 sysgpu"
Source: /tmp/yakuza.ppc.elf (PID: 6433)	Shell command executed: sh -c "pkill -9 NiGGeR69xd \|\| busybox pkill -9 NiGGeR69xd"
Source: /tmp/yakuza.ppc.elf (PID: 6442)	Shell command executed: sh -c "pkill -9 frgege \|\| busybox pkill -9 frgege"
Source: /tmp/yakuza.ppc.elf (PID: 6449)	Shell command executed: sh -c "pkill -9 sysupdater \|\| busybox pkill -9 sysupdater"
Source: /tmp/yakuza.ppc.elf (PID: 6460)	Shell command executed: sh -c "pkill -9 0DnAzepd \|\| busybox pkill -9 0DnAzepd"
Source: /tmp/yakuza.ppc.elf (PID: 6467)	Shell command executed: sh -c "pkill -9 NiGGeRD0nks69 \|\| busybox pkill -9 NiGGeRD0nks69"
Source: /tmp/yakuza.ppc.elf (PID: 6474)	Shell command executed: sh -c "pkill -9 frgreu \|\| busybox pkill -9 frgreu"
Source: /tmp/yakuza.ppc.elf (PID: 6483)	Shell command executed: sh -c "pkill -9 telnetd \|\| busybox pkill -9 telnetd"
Source: /tmp/yakuza.ppc.elf (PID: 6490)	Shell command executed: sh -c "pkill -9 0x766f6964 \|\| busybox pkill -9 0x766f6964"
Source: /tmp/yakuza.ppc.elf (PID: 6500)	Shell command executed: sh -c "pkill -9 NiGGeRd0nks1337 \|\| busybox pkill -9 NiGGeRd0nks1337"
Source: /tmp/yakuza.ppc.elf (PID: 6507)	Shell command executed: sh -c "pkill -9 gaft \|\| busybox pkill -9 gaft"
Source: /tmp/yakuza.ppc.elf (PID: 6516)	Shell command executed: sh -c "pkill -9 urasgbsigboa \|\| busybox pkill -9 urasgbsigboa"
Source: /tmp/yakuza.ppc.elf (PID: 6523)	Shell command executed: sh -c "pkill -9 120i3UI49 \|\| busybox pkill -9 120i3UI49"
Source: /tmp/yakuza.ppc.elf (PID: 6530)	Shell command executed: sh -c "pkill -9 OaF3 \|\| busybox pkill -9 OaF3"
Source: /tmp/yakuza.ppc.elf (PID: 6539)	Shell command executed: sh -c "pkill -9 geae \|\| busybox pkill -9 geae"
Source: /tmp/yakuza.ppc.elf (PID: 6547)	Shell command executed: sh -c "pkill -9 vaiolmao \|\| busybox pkill -9 vaiolmao"
Source: /tmp/yakuza.ppc.elf (PID: 6557)	Shell command executed: sh -c "pkill -9 123123a \|\| busybox pkill -9 123123a"
Source: /tmp/yakuza.ppc.elf (PID: 6564)	Shell command executed: sh -c "pkill -9 Ofurain0n4H34D \|\| busybox pkill -9 Ofurain0n4H34D"
Source: /tmp/yakuza.ppc.elf (PID: 6571)	Shell command executed: sh -c "pkill -9 ggTrex \|\| busybox pkill -9 ggTrex"
Source: /tmp/yakuza.ppc.elf (PID: 6580)	Shell command executed: sh -c "pkill -9 wasads \|\| busybox pkill -9 wasads"
Source: /tmp/yakuza.ppc.elf (PID: 6587)	Shell command executed: sh -c "pkill -9 1293194hjXD \|\| busybox pkill -9 1293194hjXD"
Source: /tmp/yakuza.ppc.elf (PID: 6596)	Shell command executed: sh -c "pkill -9 OthLaLosn \|\| busybox pkill -9 OthLaLosn"
Source: /tmp/yakuza.ppc.elf (PID: 6600)	Shell command executed: sh -c "pkill -9 ggt \|\| busybox pkill -9 ggt"
Source: /tmp/yakuza.ppc.elf (PID: 6606)	Shell command executed: sh -c "pkill -9 wget-log \|\| busybox pkill -9 wget-log"
Source: /tmp/yakuza.ppc.elf (PID: 6614)	Shell command executed: sh -c "pkill -9 1337SoraLOADER \|\| busybox pkill -9 1337SoraLOADER"
Source: /tmp/yakuza.ppc.elf (PID: 6621)	Shell command executed: sh -c "pkill -9 SAIAKINA \|\| busybox pkill -9 SAIAKINA"
Source: /tmp/yakuza.ppc.elf (PID: 6630)	Shell command executed: sh -c "pkill -9 ggtq \|\| busybox pkill -9 ggtq"
Source: /tmp/yakuza.ppc.elf (PID: 6638)	Shell command executed: sh -c "pkill -9 1378bfp919GRB1Q2 \|\| busybox pkill -9 1378bfp919GRB1Q2"
Source: /tmp/yakuza.ppc.elf (PID: 6645)	Shell command executed: sh -c "pkill -9 SAIAKUSO \|\| busybox pkill -9 SAIAKUSO"
Source: /tmp/yakuza.ppc.elf (PID: 6654)	Shell command executed: sh -c "pkill -9 ggtr \|\| busybox pkill -9 ggtr"
Source: /tmp/yakuza.ppc.elf (PID: 6662)	Shell command executed: sh -c "pkill -9 14Fa \|\| busybox pkill -9 14Fa"
Source: /tmp/yakuza.ppc.elf (PID: 6672)	Shell command executed: sh -c "pkill -9 SEXSLAVE1337 \|\| busybox pkill -9 SEXSLAVE1337"
Source: /tmp/yakuza.ppc.elf (PID: 6676)	Shell command executed: sh -c "pkill -9 ggtt \|\| busybox pkill -9 ggtt"
Source: /tmp/yakuza.ppc.elf (PID: 6684)	Shell command executed: sh -c "pkill -9 1902a3u912u3u4 \|\| busybox pkill -9 1902a3u912u3u4"
Source: /tmp/yakuza.ppc.elf (PID: 6688)	Shell command executed: sh -c "pkill -9 SO190Ij1X \|\| busybox pkill -9 SO190Ij1X"
Source: /tmp/yakuza.ppc.elf (PID: 6695)	Shell command executed: sh -c "pkill -9 haetrghbr \|\| busybox pkill -9 haetrghbr"
Source: /tmp/yakuza.ppc.elf (PID: 6701)	Shell command executed: sh -c "pkill -9 19ju3d \|\| busybox pkill -9 19ju3d"
Source: /tmp/yakuza.ppc.elf (PID: 6708)	Shell command executed: sh -c "pkill -9 SORAojkf120 \|\| busybox pkill -9 SORAojkf120"
Source: /tmp/yakuza.ppc.elf (PID: 6714)	Shell command executed: sh -c "pkill -9 hehahejeje92 \|\| busybox pkill -9 hehahejeje92"
Source: /tmp/yakuza.ppc.elf (PID: 6718)	Shell command executed: sh -c "pkill -9 2U2JDJA901F91 \|\| busybox pkill -9 2U2JDJA901F91"

Source: /bin/sh (PID: 6251)	Pkill executable: /usr/bin/pkill -> pkill -9 902i13	Jump to behavior
Source: /bin/sh (PID: 6272)	Pkill executable: /usr/bin/pkill -> pkill -9 BzSxLxBxeY	Jump to behavior
Source: /bin/sh (PID: 6282)	Pkill executable: /usr/bin/pkill -> pkill -9 HOHO-LUGO7	Jump to behavior
Source: /bin/sh (PID: 6288)	Pkill executable: /usr/bin/pkill -> pkill -9 HOHO-U79OL	Jump to behavior
Source: /bin/sh (PID: 6295)	Pkill executable: /usr/bin/pkill -> pkill -9 JuYfouyf87	Jump to behavior
Source: /bin/sh (PID: 6304)	Pkill executable: /usr/bin/pkill -> pkill -9 NiGGeR69xd	Jump to behavior
Source: /bin/sh (PID: 6312)	Pkill executable: /usr/bin/pkill -> pkill -9 SO190Ij1X	Jump to behavior
Source: /bin/sh (PID: 6320)	Pkill executable: /usr/bin/pkill -> pkill -9 LOLKIKEEEDDE	Jump to behavior
Source: /bin/sh (PID: 6329)	Pkill executable: /usr/bin/pkill -> pkill -9 ekjheory98e	Jump to behavior
Source: /bin/sh (PID: 6333)	Pkill executable: /usr/bin/pkill -> pkill -9 scansh4	Jump to behavior
Source: /bin/sh (PID: 6358)	Pkill executable: /usr/bin/pkill -> pkill -9 MDMA	Jump to behavior
Source: /bin/sh (PID: 6362)	Pkill executable: /usr/bin/pkill -> pkill -9 fdevalvex	Jump to behavior
Source: /bin/sh (PID: 6366)	Pkill executable: /usr/bin/pkill -> pkill -9 scanspc	Jump to behavior
Source: /bin/sh (PID: 6375)	Pkill executable: /usr/bin/pkill -> pkill -9 MELTEDNINJAREALZ	Jump to behavior
Source: /bin/sh (PID: 6379)	Pkill executable: /usr/bin/pkill -> pkill -9 flexsonskids	Jump to behavior
Source: /bin/sh (PID: 6385)	Pkill executable: /usr/bin/pkill -> pkill -9 scanx86	Jump to behavior
Source: /bin/sh (PID: 6389)	Pkill executable: /usr/bin/pkill -> pkill -9 MISAKI-U79OL
Source: /bin/sh (PID: 6397)	Pkill executable: /usr/bin/pkill -> pkill -9 foAxi102kxe
Source: /bin/sh (PID: 6406)	Pkill executable: /usr/bin/pkill -> pkill -9 swodjwodjwoj
Source: /bin/sh (PID: 6413)	Pkill executable: /usr/bin/pkill -> pkill -9 MmKiy7f87l
Source: /bin/sh (PID: 6422)	Pkill executable: /usr/bin/pkill -> pkill -9 freecookiex86
Source: /bin/sh (PID: 6431)	Pkill executable: /usr/bin/pkill -> pkill -9 sysgpu
Source: /bin/sh (PID: 6438)	Pkill executable: /usr/bin/pkill -> pkill -9 NiGGeR69xd
Source: /bin/sh (PID: 6447)	Pkill executable: /usr/bin/pkill -> pkill -9 frgege
Source: /bin/sh (PID: 6454)	Pkill executable: /usr/bin/pkill -> pkill -9 sysupdater
Source: /bin/sh (PID: 6464)	Pkill executable: /usr/bin/pkill -> pkill -9 0DnAzepd
Source: /bin/sh (PID: 6472)	Pkill executable: /usr/bin/pkill -> pkill -9 NiGGeRD0nks69
Source: /bin/sh (PID: 6479)	Pkill executable: /usr/bin/pkill -> pkill -9 frgreu
Source: /bin/sh (PID: 6488)	Pkill executable: /usr/bin/pkill -> pkill -9 telnetd
Source: /bin/sh (PID: 6496)	Pkill executable: /usr/bin/pkill -> pkill -9 0x766f6964
Source: /bin/sh (PID: 6505)	Pkill executable: /usr/bin/pkill -> pkill -9 NiGGeRd0nks1337
Source: /bin/sh (PID: 6512)	Pkill executable: /usr/bin/pkill -> pkill -9 gaft
Source: /bin/sh (PID: 6521)	Pkill executable: /usr/bin/pkill -> pkill -9 urasgbsigboa
Source: /bin/sh (PID: 6528)	Pkill executable: /usr/bin/pkill -> pkill -9 120i3UI49
Source: /bin/sh (PID: 6535)	Pkill executable: /usr/bin/pkill -> pkill -9 OaF3
Source: /bin/sh (PID: 6544)	Pkill executable: /usr/bin/pkill -> pkill -9 geae
Source: /bin/sh (PID: 6553)	Pkill executable: /usr/bin/pkill -> pkill -9 vaiolmao
Source: /bin/sh (PID: 6562)	Pkill executable: /usr/bin/pkill -> pkill -9 123123a
Source: /bin/sh (PID: 6569)	Pkill executable: /usr/bin/pkill -> pkill -9 Ofurain0n4H34D
Source: /bin/sh (PID: 6576)	Pkill executable: /usr/bin/pkill -> pkill -9 ggTrex
Source: /bin/sh (PID: 6585)	Pkill executable: /usr/bin/pkill -> pkill -9 wasads
Source: /bin/sh (PID: 6592)	Pkill executable: /usr/bin/pkill -> pkill -9 1293194hjXD
Source: /bin/sh (PID: 6598)	Pkill executable: /usr/bin/pkill -> pkill -9 OthLaLosn
Source: /bin/sh (PID: 6602)	Pkill executable: /usr/bin/pkill -> pkill -9 ggt
Source: /bin/sh (PID: 6612)	Pkill executable: /usr/bin/pkill -> pkill -9 wget-log
Source: /bin/sh (PID: 6619)	Pkill executable: /usr/bin/pkill -> pkill -9 1337SoraLOADER
Source: /bin/sh (PID: 6626)	Pkill executable: /usr/bin/pkill -> pkill -9 SAIAKINA
Source: /bin/sh (PID: 6635)	Pkill executable: /usr/bin/pkill -> pkill -9 ggtq
Source: /bin/sh (PID: 6643)	Pkill executable: /usr/bin/pkill -> pkill -9 1378bfp919GRB1Q2
Source: /bin/sh (PID: 6650)	Pkill executable: /usr/bin/pkill -> pkill -9 SAIAKUSO
Source: /bin/sh (PID: 6658)	Pkill executable: /usr/bin/pkill -> pkill -9 ggtr
Source: /bin/sh (PID: 6668)	Pkill executable: /usr/bin/pkill -> pkill -9 14Fa
Source: /bin/sh (PID: 6674)	Pkill executable: /usr/bin/pkill -> pkill -9 SEXSLAVE1337
Source: /bin/sh (PID: 6678)	Pkill executable: /usr/bin/pkill -> pkill -9 ggtt
Source: /bin/sh (PID: 6686)	Pkill executable: /usr/bin/pkill -> pkill -9 1902a3u912u3u4
Source: /bin/sh (PID: 6693)	Pkill executable: /usr/bin/pkill -> pkill -9 SO190Ij1X
Source: /bin/sh (PID: 6697)	Pkill executable: /usr/bin/pkill -> pkill -9 haetrghbr
Source: /bin/sh (PID: 6706)	Pkill executable: /usr/bin/pkill -> pkill -9 19ju3d
Source: /bin/sh (PID: 6710)	Pkill executable: /usr/bin/pkill -> pkill -9 SORAojkf120
Source: /bin/sh (PID: 6716)	Pkill executable: /usr/bin/pkill -> pkill -9 hehahejeje92
Source: /bin/sh (PID: 6724)	Pkill executable: /usr/bin/pkill -> pkill -9 2U2JDJA901F91

Source: /usr/bin/pkill (PID: 6251)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6272)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6282)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6288)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6295)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6304)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6312)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6320)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6329)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6333)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6358)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6362)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6366)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6375)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6379)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6385)	Reads CPU info from /sys: /sys/devices/system/cpu/online	Jump to behavior
Source: /usr/bin/pkill (PID: 6389)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6397)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6406)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6413)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6422)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6431)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6438)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6447)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6454)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6464)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6472)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6479)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6488)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6496)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6505)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6512)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6521)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6528)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6535)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6544)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6553)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6562)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6569)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6576)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6585)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6592)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6598)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6602)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6612)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6619)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6626)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6635)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6643)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6650)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6658)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6668)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6674)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6678)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6686)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6693)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6697)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6706)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6710)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6716)	Reads CPU info from /sys: /sys/devices/system/cpu/online
Source: /usr/bin/pkill (PID: 6724)	Reads CPU info from /sys: /sys/devices/system/cpu/online

Source: /tmp/yakuza.ppc.elf (PID: 6234)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 6266)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 6279)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 6285)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 6289)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 6296)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 6305)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 6313)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 6323)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 6330)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 6353)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 6359)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 6363)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 6369)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 6376)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 6382)	Queries kernel information via 'uname':	Jump to behavior
Source: /usr/bin/busybox (PID: 6386)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6390)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6400)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6407)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6414)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6423)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6432)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6441)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6448)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6457)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6466)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6473)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6482)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6489)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6499)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6506)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6513)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6522)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6529)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6538)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6546)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6554)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6563)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6570)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6579)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6586)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6593)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6599)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6603)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6613)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6620)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6627)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6637)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6644)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6653)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6661)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6671)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6675)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6681)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6687)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6694)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6700)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6707)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6711)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6717)	Queries kernel information via 'uname':
Source: /usr/bin/busybox (PID: 6725)	Queries kernel information via 'uname':

Source: yakuza.ppc.elf, 6234.1.000055ac348a2000.000055ac34952000.rw-.sdmp	Binary or memory string: !/etc/qemu-binfmt/ppc11!hotpluggableq
Source: yakuza.ppc.elf, 6243.1.000055ac348a2000.000055ac34931000.rw-.sdmp	Binary or memory string: !/etc/qemu-binfmt/ppc1
Source: yakuza.ppc.elf, 6234.1.000055ac348a2000.000055ac34952000.rw-.sdmp, yakuza.ppc.elf, 6243.1.000055ac348a2000.000055ac34931000.rw-.sdmp	Binary or memory string: /etc/qemu-binfmt/ppc
Source: yakuza.ppc.elf, 6234.1.00007ffd0450e000.00007ffd0452f000.rw-.sdmp, yakuza.ppc.elf, 6243.1.00007ffd0450e000.00007ffd0452f000.rw-.sdmp	Binary or memory string: /usr/bin/qemu-ppc
Source: yakuza.ppc.elf, 6243.1.00007ffd0450e000.00007ffd0452f000.rw-.sdmp	Binary or memory string: qemu: uncaught target signal 11 (Segmentation fault) - core dumped
Source: yakuza.ppc.elf, 6234.1.00007ffd0450e000.00007ffd0452f000.rw-.sdmp, yakuza.ppc.elf, 6243.1.00007ffd0450e000.00007ffd0452f000.rw-.sdmp	Binary or memory string: x86_64/usr/bin/qemu-ppc/tmp/yakuza.ppc.elfSUDO_USER=saturninoPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/binDISPLAY=:1.0XAUTHORITY=/run/user/1000/gdm/XauthoritySUDO_UID=1000TERM=xterm-256colorCOLORTERM=truecolorLOGNAME=rootUSER=rootLANG=en_US.UTF-8SUDO_COMMAND=/bin/bashHOME=/rootMAIL=/var/mail/rootSUDO_GID=1000SHELL=/bin/bash/tmp/yakuza.ppc.elf

Stealing of Sensitive Information

Yara detected Mirai

Source: Yara match	File source: yakuza.ppc.elf, type: SAMPLE
Source: Yara match	File source: 6234.1.00007f88b0001000.00007f88b001c000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6243.1.00007f88b0001000.00007f88b001c000.r-x.sdmp, type: MEMORY

Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:48.0) Gecko/20100101 Firefox/48.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; U; Intel Mac OS X; en; rv:1.8.1.11) Gecko/20071128 Camino/1.5.4
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; rv:2.2) Gecko/20110201
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Windows NT 6.1; cs; rv:1.9.2.6) Gecko/20100628 myibrow/4alpha2
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows; U; Win 9x 4.90; SG; rv:1.9.2.4) Gecko/20101104 Netscape/9.1.0285
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.2.0 Lightning/4.0.2
Source: Initial sample	User agent string found: Opera/9.80 (X11; Linux i686; Ubuntu/14.10) Presto/2.12.388 Version/12.16
Source: Initial sample	User agent string found: Opera/9.80 (Windows NT 5.1; U;) Presto/2.7.62 Version/11.01
Source: Initial sample	User agent string found: Mozilla/5.0 (X11; Linux x86_64; U; de; rv:1.9.1.6) Gecko/20091201 Firefox/3.5.6 Opera 10.62
Source: Initial sample	User agent string found: Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Linux; Android 4.4.3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/50.0.2661.89 Mobile Safari/537.36
Source: Initial sample	User agent string found: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.6; rv:5.0) Gecko/20110517 Firefox/5.0 Fennec/5.0
Source: Initial sample	User agent string found: Mozilla/5.0 (Android; Linux armv7l; rv:9.0) Gecko/20111216 Firefox/9.0 Fennec/9.0
Source: Initial sample	User agent string found: Mozilla/5.0 (compatible; Teleca Q7; Brew 3.1.5; U; en) 480X800 LGE VX11000

Remote Access Functionality

Yara detected Mirai

Source: Yara match	File source: yakuza.ppc.elf, type: SAMPLE
Source: Yara match	File source: 6234.1.00007f88b0001000.00007f88b001c000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 6243.1.00007f88b0001000.00007f88b001c000.r-x.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Scripting	Path Interception	1 Masquerading	1 OS Credential Dumping	11 Security Software Discovery	Remote Services	Data from Local System	1 Data Obfuscation	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	1 Brute Force	1 File and Directory Discovery	Remote Desktop Protocol	Data from Removable Media	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	1 System Information Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
yakuza.ppc.elf	55%	ReversingLabs	Linux.Trojan.Tsunami

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
pirati.privatedns.org	212.171.15.94	true	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://youtu.be/dQw4w9WgXcQ	yakuza.ppc.elf	false	high
http://linux-it.abuser.eu/yak.sh;	yakuza.ppc.elf	false	high
https://youtu.be/dQw4w9WgXcQNever	yakuza.ppc.elf	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.43	most-mips.elf	Get hash	malicious	Mirai	Browse
	most-mpsl.elf	Get hash	malicious	Mirai	Browse
	arm4.elf	Get hash	malicious	Gafgyt	Browse
	mpsl.elf	Get hash	malicious	Gafgyt	Browse
	boatnet.x86.elf	Get hash	malicious	Mirai	Browse
	CONSTANT_STRATEGY.elf	Get hash	malicious	Unknown	Browse
	boatnet.m68k.elf	Get hash	malicious	Mirai	Browse
	boatnet.spc.elf	Get hash	malicious	Mirai	Browse
	win.elf	Get hash	malicious	Unknown	Browse
	45.200.149.186-boatnet.arm6-2024-12-28T01_23_00.elf	Get hash	malicious	Mirai	Browse
91.189.91.42	most-mips.elf	Get hash	malicious	Mirai	Browse
	most-mpsl.elf	Get hash	malicious	Mirai	Browse
	arm4.elf	Get hash	malicious	Gafgyt	Browse
	mpsl.elf	Get hash	malicious	Gafgyt	Browse
	boatnet.x86.elf	Get hash	malicious	Mirai	Browse
	CONSTANT_STRATEGY.elf	Get hash	malicious	Unknown	Browse
	boatnet.m68k.elf	Get hash	malicious	Mirai	Browse
	boatnet.spc.elf	Get hash	malicious	Mirai	Browse
	win.elf	Get hash	malicious	Unknown	Browse
	45.200.149.186-boatnet.arm6-2024-12-28T01_23_00.elf	Get hash	malicious	Mirai	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	most-mips.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	most-mpsl.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	arm4.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	x86_64.elf	Get hash	malicious	Gafgyt	Browse	185.125.190.26
	mpsl.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	boatnet.x86.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	CONSTANT_STRATEGY.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	boatnet.m68k.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	boatnet.spc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	win.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
CANONICAL-ASGB	most-mips.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	most-mpsl.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	arm4.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	x86_64.elf	Get hash	malicious	Gafgyt	Browse	185.125.190.26
	mpsl.elf	Get hash	malicious	Gafgyt	Browse	91.189.91.42
	boatnet.x86.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	CONSTANT_STRATEGY.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	boatnet.m68k.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	boatnet.spc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	win.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
INIT7CH	most-mips.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	most-mpsl.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	arm4.elf	Get hash	malicious	Gafgyt	Browse	109.202.202.202
	mpsl.elf	Get hash	malicious	Gafgyt	Browse	109.202.202.202
	boatnet.x86.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	CONSTANT_STRATEGY.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	boatnet.m68k.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	boatnet.spc.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	win.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	45.200.149.186-boatnet.arm6-2024-12-28T01_23_00.elf	Get hash	malicious	Mirai	Browse	109.202.202.202

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	ELF 32-bit MSB executable, PowerPC or cisco 4500, version 1 (SYSV), statically linked, not stripped
Entropy (8bit):	6.187122211415835
TrID:	ELF Executable and Linkable format (generic) (4004/1) 100.00%
File name:	yakuza.ppc.elf
File size:	143'381 bytes
MD5:	c664c20d42ee503217b65e793e4b126e
SHA1:	28b8de0c41219ef0fadd15b138ca7a521cf9ef2c
SHA256:	b2ae29e1b6aa1036e7a048153494ea7c34b2e1c40711fafd4adef4b9f829dd38
SHA512:	3c2be3b8361fd94cbe596e0e7f45a5eaee810914d88448daef2aa5f6c1ac293416278170bbfc5d5beb8b1e24b786b273f94aa10cbe6808fda4783a439e2d427b
SSDEEP:	3072:IORVfRIwVGpkfhTkmHIyYWriuZBnvvWnDf4urTpzI:I2VfGwV0GhokrRnvvWnDf4urTpzI
TLSH:	4BE35B9BA70D1767C1BB1AF12DB733F087ADFA6102662184A40DFFC01372A746616F99
File Content Preview:	.ELF...........................4...h.....4. ...(.......................d...d........................................dt.Q.............................!..\|......$H...H.U....$8!. \|...N.. .!..\|.......?..........P..../...@..\?........+../...A..$8...})......N..

Static ELF Info

ELF header
Class:	ELF32
Data:	2's complement, big endian
Version:	1 (current)
Machine:	PowerPC
Version Number:	0x1
Type:	EXEC (Executable file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x100001f0
Flags:	0x0
ELF Header Size:	52
Program Header Offset:	52
Program Header Size:	32
Number of Program Headers:	3
Section Header Offset:	117608
Section Header Size:	40
Number of Section Headers:	17
Header String Table Index:	14

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.init	PROGBITS	0x10000094	0x94	0x24	0x0	0x6	AX	0	0	4
.text	PROGBITS	0x100000b8	0xb8	0x15654	0x0	0x6	AX	0	0	4
.fini	PROGBITS	0x1001570c	0x1570c	0x20	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x10015730	0x15730	0x5830	0x0	0x2	A	0	0	8
.eh_frame	PROGBITS	0x1001af60	0x1af60	0x4	0x0	0x2	A	0	0	4
.ctors	PROGBITS	0x1002b000	0x1b000	0x8	0x0	0x3	WA	0	0	4
.dtors	PROGBITS	0x1002b008	0x1b008	0x8	0x0	0x3	WA	0	0	4
.jcr	PROGBITS	0x1002b010	0x1b010	0x4	0x0	0x3	WA	0	0	4
.data	PROGBITS	0x1002b018	0x1b018	0xd18	0x0	0x3	WA	0	0	8
.sdata	PROGBITS	0x1002bd30	0x1bd30	0x68	0x0	0x3	WA	0	0	4
.sbss	NOBITS	0x1002bd98	0x1bd98	0xb8	0x0	0x3	WA	0	0	4
.bss	NOBITS	0x1002be50	0x1bd98	0x7738	0x0	0x3	WA	0	0	4
.comment	PROGBITS	0x0	0x1bd98	0xd5c	0x0	0x0		0	0	1
.shstrtab	STRTAB	0x0	0x1caf4	0x73	0x0	0x0		0	0	1
.symtab	SYMTAB	0x0	0x1ce10	0x3870	0x10	0x0		16	301	4
.strtab	STRTAB	0x0	0x20680	0x2995	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Section Mappings
LOAD	0x0	0x10000000	0x10000000	0x1af64	0x1af64	6.2411	0x5	R E	0x10000	.init .text .fini .rodata .eh_frame
LOAD	0x1b000	0x1002b000	0x1002b000	0xd98	0x8588	4.5666	0x6	RW	0x10000	.ctors .dtors .jcr .data .sdata .sbss .bss
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x4

Symbols

Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
	.symtab	0x10000094	0	SECTION	<unknown>	DEFAULT	1
	.symtab	0x100000b8	0	SECTION	<unknown>	DEFAULT	2
	.symtab	0x1001570c	0	SECTION	<unknown>	DEFAULT	3
	.symtab	0x10015730	0	SECTION	<unknown>	DEFAULT	4
	.symtab	0x1001af60	0	SECTION	<unknown>	DEFAULT	5
	.symtab	0x1002b000	0	SECTION	<unknown>	DEFAULT	6
	.symtab	0x1002b008	0	SECTION	<unknown>	DEFAULT	7
	.symtab	0x1002b010	0	SECTION	<unknown>	DEFAULT	8
	.symtab	0x1002b018	0	SECTION	<unknown>	DEFAULT	9
	.symtab	0x1002bd30	0	SECTION	<unknown>	DEFAULT	10
	.symtab	0x1002bd98	0	SECTION	<unknown>	DEFAULT	11
	.symtab	0x1002be50	0	SECTION	<unknown>	DEFAULT	12
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	13
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	14
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	15
	.symtab	0x0	0	SECTION	<unknown>	DEFAULT	16
C.71.5596	.symtab	0x10017600	36	OBJECT	<unknown>	DEFAULT	4
C.89.5815	.symtab	0x10017c78	312	OBJECT	<unknown>	DEFAULT	4
C.96.5912	.symtab	0x10017e24	12	OBJECT	<unknown>	DEFAULT	4
ClearHistory	.symtab	0x1000790c	80	FUNC	<unknown>	DEFAULT	2
HTTP	.symtab	0x10002dc4	396	FUNC	<unknown>	DEFAULT	2
Q	.symtab	0x1002c26c	16384	OBJECT	<unknown>	DEFAULT	12
Send	.symtab	0x10000530	212	FUNC	<unknown>	DEFAULT	2
UserAgents	.symtab	0x1002b338	144	OBJECT	<unknown>	DEFAULT	9
_352	.symtab	0x10009238	40	FUNC	<unknown>	DEFAULT	2
_376	.symtab	0x1000912c	188	FUNC	<unknown>	DEFAULT	2
_433	.symtab	0x10009260	108	FUNC	<unknown>	DEFAULT	2
_Jv_RegisterClasses	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_NICK	.symtab	0x100092cc	300	FUNC	<unknown>	DEFAULT	2
_PING	.symtab	0x100091e8	80	FUNC	<unknown>	DEFAULT	2
_PRIVMSG	.symtab	0x100084e0	3148	FUNC	<unknown>	DEFAULT	2
_READ.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_SDA_BASE_	.symtab	0x10033d30	0	NOTYPE	<unknown>	DEFAULT	10
_WRITE.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__CTOR_END__	.symtab	0x1002b004	0	OBJECT	<unknown>	DEFAULT	6
__CTOR_LIST__	.symtab	0x1002b000	0	OBJECT	<unknown>	DEFAULT	6
__C_ctype_b	.symtab	0x1002bd88	4	OBJECT	<unknown>	DEFAULT	10
__C_ctype_b.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_b_data	.symtab	0x1001a842	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_tolower	.symtab	0x1002bd90	4	OBJECT	<unknown>	DEFAULT	10
__C_ctype_tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_tolower_data	.symtab	0x1001ab42	768	OBJECT	<unknown>	DEFAULT	4
__C_ctype_toupper	.symtab	0x1002bd5c	4	OBJECT	<unknown>	DEFAULT	10
__C_ctype_toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__C_ctype_toupper_data	.symtab	0x100195b4	768	OBJECT	<unknown>	DEFAULT	4
__DTOR_END__	.symtab	0x1002b00c	0	OBJECT	<unknown>	DEFAULT	7
__DTOR_LIST__	.symtab	0x1002b008	0	OBJECT	<unknown>	DEFAULT	7
__EH_FRAME_BEGIN__	.symtab	0x1001af60	0	OBJECT	<unknown>	DEFAULT	5
__FRAME_END__	.symtab	0x1001af60	0	OBJECT	<unknown>	DEFAULT	5
__GI___C_ctype_b	.symtab	0x1002bd88	4	OBJECT	<unknown>	HIDDEN	10
__GI___C_ctype_b_data	.symtab	0x1001a842	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_tolower	.symtab	0x1002bd90	4	OBJECT	<unknown>	HIDDEN	10
__GI___C_ctype_tolower_data	.symtab	0x1001ab42	768	OBJECT	<unknown>	HIDDEN	4
__GI___C_ctype_toupper	.symtab	0x1002bd5c	4	OBJECT	<unknown>	HIDDEN	10
__GI___C_ctype_toupper_data	.symtab	0x100195b4	768	OBJECT	<unknown>	HIDDEN	4
__GI___ctype_b	.symtab	0x1002bd8c	4	OBJECT	<unknown>	HIDDEN	10
__GI___ctype_tolower	.symtab	0x1002bd94	4	OBJECT	<unknown>	HIDDEN	10
__GI___ctype_toupper	.symtab	0x1002bd60	4	OBJECT	<unknown>	HIDDEN	10
__GI___errno_location	.symtab	0x1000aa10	12	FUNC	<unknown>	HIDDEN	2
__GI___fgetc_unlocked	.symtab	0x1001235c	312	FUNC	<unknown>	HIDDEN	2
__GI___fputc_unlocked	.symtab	0x1000cde4	292	FUNC	<unknown>	HIDDEN	2
__GI___glibc_strerror_r	.symtab	0x1000d4d8	48	FUNC	<unknown>	HIDDEN	2
__GI___h_errno_location	.symtab	0x100115f8	12	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl	.symtab	0x1000a404	132	FUNC	<unknown>	HIDDEN	2
__GI___libc_fcntl64	.symtab	0x1000a488	100	FUNC	<unknown>	HIDDEN	2
__GI___libc_open	.symtab	0x100113d8	120	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_fini	.symtab	0x10010d18	148	FUNC	<unknown>	HIDDEN	2
__GI___uClibc_init	.symtab	0x10010e18	128	FUNC	<unknown>	HIDDEN	2
__GI___xpg_strerror_r	.symtab	0x1000d508	268	FUNC	<unknown>	HIDDEN	2
__GI__exit	.symtab	0x1001115c	60	FUNC	<unknown>	HIDDEN	2
__GI_abort	.symtab	0x1001454c	336	FUNC	<unknown>	HIDDEN	2
__GI_accept	.symtab	0x1000f6f4	52	FUNC	<unknown>	HIDDEN	2
__GI_asprintf	.symtab	0x1000acf0	128	FUNC	<unknown>	HIDDEN	2
__GI_atoi	.symtab	0x100105e0	12	FUNC	<unknown>	HIDDEN	2
__GI_atol	.symtab	0x100105e0	12	FUNC	<unknown>	HIDDEN	2
__GI_bind	.symtab	0x1000f728	52	FUNC	<unknown>	HIDDEN	2
__GI_brk	.symtab	0x100146ec	52	FUNC	<unknown>	HIDDEN	2
__GI_chdir	.symtab	0x1000a4ec	72	FUNC	<unknown>	HIDDEN	2
__GI_clock_getres	.symtab	0x10011198	72	FUNC	<unknown>	HIDDEN	2
__GI_close	.symtab	0x1000a534	72	FUNC	<unknown>	HIDDEN	2
__GI_connect	.symtab	0x1000f75c	52	FUNC	<unknown>	HIDDEN	2
__GI_dup2	.symtab	0x100111e0	72	FUNC	<unknown>	HIDDEN	2
__GI_endservent	.symtab	0x10012c10	128	FUNC	<unknown>	HIDDEN	2
__GI_errno	.symtab	0x1002be20	4	OBJECT	<unknown>	HIDDEN	11
__GI_execl	.symtab	0x10010834	308	FUNC	<unknown>	HIDDEN	2
__GI_execve	.symtab	0x10011228	72	FUNC	<unknown>	HIDDEN	2
__GI_exit	.symtab	0x100107b0	132	FUNC	<unknown>	HIDDEN	2
__GI_fclose	.symtab	0x1000aa1c	332	FUNC	<unknown>	HIDDEN	2
__GI_fcntl	.symtab	0x1000a404	132	FUNC	<unknown>	HIDDEN	2
__GI_fcntl64	.symtab	0x1000a488	100	FUNC	<unknown>	HIDDEN	2
__GI_fdopen	.symtab	0x1001173c	100	FUNC	<unknown>	HIDDEN	2
__GI_fflush_unlocked	.symtab	0x1000cb70	432	FUNC	<unknown>	HIDDEN	2
__GI_fgetc_unlocked	.symtab	0x1001235c	312	FUNC	<unknown>	HIDDEN	2
__GI_fgets	.symtab	0x1000c864	148	FUNC	<unknown>	HIDDEN	2
__GI_fgets_unlocked	.symtab	0x1000cd20	196	FUNC	<unknown>	HIDDEN	2
__GI_fopen	.symtab	0x1000ab68	12	FUNC	<unknown>	HIDDEN	2
__GI_fork	.symtab	0x1000a57c	72	FUNC	<unknown>	HIDDEN	2
__GI_fprintf	.symtab	0x1000ac70	128	FUNC	<unknown>	HIDDEN	2
__GI_fputc	.symtab	0x1000c8f8	204	FUNC	<unknown>	HIDDEN	2
__GI_fputs	.symtab	0x1000c9c4	140	FUNC	<unknown>	HIDDEN	2
__GI_fputs_unlocked	.symtab	0x1000cf08	92	FUNC	<unknown>	HIDDEN	2
__GI_freeaddrinfo	.symtab	0x1000e5dc	64	FUNC	<unknown>	HIDDEN	2
__GI_fseek	.symtab	0x10014768	16	FUNC	<unknown>	HIDDEN	2
__GI_fseeko64	.symtab	0x10014808	284	FUNC	<unknown>	HIDDEN	2
__GI_fwrite_unlocked	.symtab	0x1000cf64	184	FUNC	<unknown>	HIDDEN	2
__GI_getaddrinfo	.symtab	0x1000e61c	756	FUNC	<unknown>	HIDDEN	2
__GI_getc_unlocked	.symtab	0x1001235c	312	FUNC	<unknown>	HIDDEN	2
__GI_getcwd	.symtab	0x1000a5c4	256	FUNC	<unknown>	HIDDEN	2
__GI_getdtablesize	.symtab	0x1000a6c4	56	FUNC	<unknown>	HIDDEN	2
__GI_getegid	.symtab	0x10011270	72	FUNC	<unknown>	HIDDEN	2
__GI_geteuid	.symtab	0x100112b8	72	FUNC	<unknown>	HIDDEN	2
__GI_getgid	.symtab	0x10011300	72	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyaddr_r	.symtab	0x1000f3bc	824	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname2_r	.symtab	0x1000f0e4	728	FUNC	<unknown>	HIDDEN	2
__GI_gethostbyname_r	.symtab	0x10013f90	836	FUNC	<unknown>	HIDDEN	2
__GI_getpagesize	.symtab	0x1000a6fc	28	FUNC	<unknown>	HIDDEN	2
__GI_getpid	.symtab	0x1000a718	72	FUNC	<unknown>	HIDDEN	2
__GI_getrlimit	.symtab	0x1000a7a8	72	FUNC	<unknown>	HIDDEN	2
__GI_getservbyname_r	.symtab	0x10012e6c	284	FUNC	<unknown>	HIDDEN	2
__GI_getservbyport	.symtab	0x10012e14	88	FUNC	<unknown>	HIDDEN	2
__GI_getservbyport_r	.symtab	0x10012d30	228	FUNC	<unknown>	HIDDEN	2
__GI_getservent_r	.symtab	0x10012990	576	FUNC	<unknown>	HIDDEN	2
__GI_getuid	.symtab	0x10011348	72	FUNC	<unknown>	HIDDEN	2
__GI_h_errno	.symtab	0x1002be24	4	OBJECT	<unknown>	HIDDEN	11
__GI_if_freenameindex	.symtab	0x10013310	88	FUNC	<unknown>	HIDDEN	2
__GI_if_nameindex	.symtab	0x10013134	476	FUNC	<unknown>	HIDDEN	2
__GI_if_nametoindex	.symtab	0x1001308c	168	FUNC	<unknown>	HIDDEN	2
__GI_in6addr_loopback	.symtab	0x1001a578	16	OBJECT	<unknown>	HIDDEN	4
__GI_inet_addr	.symtab	0x1000f0b0	52	FUNC	<unknown>	HIDDEN	2
__GI_inet_aton	.symtab	0x10013368	192	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa	.symtab	0x1000f07c	52	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntoa_r	.symtab	0x1000f000	124	FUNC	<unknown>	HIDDEN	2
__GI_inet_ntop	.symtab	0x1000ed5c	676	FUNC	<unknown>	HIDDEN	2
__GI_inet_pton	.symtab	0x1000e9f0	524	FUNC	<unknown>	HIDDEN	2
__GI_initstate_r	.symtab	0x100103a4	232	FUNC	<unknown>	HIDDEN	2
__GI_ioctl	.symtab	0x1000a31c	232	FUNC	<unknown>	HIDDEN	2
__GI_isatty	.symtab	0x1000d734	44	FUNC	<unknown>	HIDDEN	2
__GI_kill	.symtab	0x1000a7f0	72	FUNC	<unknown>	HIDDEN	2
__GI_listen	.symtab	0x1000f7cc	48	FUNC	<unknown>	HIDDEN	2
__GI_lseek64	.symtab	0x100154c4	128	FUNC	<unknown>	HIDDEN	2
__GI_memchr	.symtab	0x10012538	264	FUNC	<unknown>	HIDDEN	2
__GI_memcpy	.symtab	0x1000d01c	156	FUNC	<unknown>	HIDDEN	2
__GI_memmove	.symtab	0x10012494	164	FUNC	<unknown>	HIDDEN	2
__GI_mempcpy	.symtab	0x10012640	52	FUNC	<unknown>	HIDDEN	2
__GI_memrchr	.symtab	0x10012674	244	FUNC	<unknown>	HIDDEN	2
__GI_memset	.symtab	0x1000d0b8	144	FUNC	<unknown>	HIDDEN	2
__GI_nanosleep	.symtab	0x10011390	72	FUNC	<unknown>	HIDDEN	2
__GI_open	.symtab	0x100113d8	120	FUNC	<unknown>	HIDDEN	2
__GI_perror	.symtab	0x1000ab74	68	FUNC	<unknown>	HIDDEN	2
__GI_pipe	.symtab	0x10011460	72	FUNC	<unknown>	HIDDEN	2
__GI_poll	.symtab	0x1000a838	72	FUNC	<unknown>	HIDDEN	2
__GI_putc	.symtab	0x1000c8f8	204	FUNC	<unknown>	HIDDEN	2
__GI_putc_unlocked	.symtab	0x1000cde4	292	FUNC	<unknown>	HIDDEN	2
__GI_raise	.symtab	0x10015494	48	FUNC	<unknown>	HIDDEN	2
__GI_random	.symtab	0x1000ff58	108	FUNC	<unknown>	HIDDEN	2
__GI_random_r	.symtab	0x10010230	144	FUNC	<unknown>	HIDDEN	2
__GI_rawmemchr	.symtab	0x10014bd8	184	FUNC	<unknown>	HIDDEN	2
__GI_read	.symtab	0x10015544	72	FUNC	<unknown>	HIDDEN	2
__GI_recv	.symtab	0x1000f7fc	56	FUNC	<unknown>	HIDDEN	2
__GI_rewind	.symtab	0x10014778	144	FUNC	<unknown>	HIDDEN	2
__GI_sbrk	.symtab	0x100114a8	112	FUNC	<unknown>	HIDDEN	2
__GI_select	.symtab	0x1000a880	72	FUNC	<unknown>	HIDDEN	2
__GI_send	.symtab	0x1000f834	56	FUNC	<unknown>	HIDDEN	2
__GI_sendto	.symtab	0x1000f86c	64	FUNC	<unknown>	HIDDEN	2
__GI_setservent	.symtab	0x10012c90	160	FUNC	<unknown>	HIDDEN	2
__GI_setsid	.symtab	0x1000a8c8	72	FUNC	<unknown>	HIDDEN	2
__GI_setsockopt	.symtab	0x1000f8ac	60	FUNC	<unknown>	HIDDEN	2
__GI_setstate_r	.symtab	0x1001013c	244	FUNC	<unknown>	HIDDEN	2
__GI_sigaction	.symtab	0x10014330	196	FUNC	<unknown>	HIDDEN	2
__GI_signal	.symtab	0x100143f4	224	FUNC	<unknown>	HIDDEN	2
__GI_sigprocmask	.symtab	0x10011518	120	FUNC	<unknown>	HIDDEN	2
__GI_sleep	.symtab	0x10010968	468	FUNC	<unknown>	HIDDEN	2
__GI_socket	.symtab	0x1000f8e8	52	FUNC	<unknown>	HIDDEN	2
__GI_sprintf	.symtab	0x1000ad70	140	FUNC	<unknown>	HIDDEN	2
__GI_srandom_r	.symtab	0x100102c0	228	FUNC	<unknown>	HIDDEN	2
__GI_strcasecmp	.symtab	0x1000d624	80	FUNC	<unknown>	HIDDEN	2
__GI_strcasestr	.symtab	0x1000d674	100	FUNC	<unknown>	HIDDEN	2
__GI_strchr	.symtab	0x10012768	256	FUNC	<unknown>	HIDDEN	2
__GI_strcmp	.symtab	0x1000d148	52	FUNC	<unknown>	HIDDEN	2
__GI_strcoll	.symtab	0x1000d148	52	FUNC	<unknown>	HIDDEN	2
__GI_strcpy	.symtab	0x1000d17c	32	FUNC	<unknown>	HIDDEN	2
__GI_strdup	.symtab	0x1000d6d8	80	FUNC	<unknown>	HIDDEN	2
__GI_strlen	.symtab	0x1000d19c	164	FUNC	<unknown>	HIDDEN	2
__GI_strncat	.symtab	0x10014c90	208	FUNC	<unknown>	HIDDEN	2
__GI_strncmp	.symtab	0x1000d240	236	FUNC	<unknown>	HIDDEN	2
__GI_strncpy	.symtab	0x1000d32c	188	FUNC	<unknown>	HIDDEN	2
__GI_strnlen	.symtab	0x1000d3e8	240	FUNC	<unknown>	HIDDEN	2
__GI_strpbrk	.symtab	0x10012908	60	FUNC	<unknown>	HIDDEN	2
__GI_strspn	.symtab	0x10014d60	76	FUNC	<unknown>	HIDDEN	2
__GI_strtok	.symtab	0x1000d728	12	FUNC	<unknown>	HIDDEN	2
__GI_strtok_r	.symtab	0x10012868	160	FUNC	<unknown>	HIDDEN	2
__GI_strtol	.symtab	0x100105ec	8	FUNC	<unknown>	HIDDEN	2
__GI_strtoul	.symtab	0x100105f4	8	FUNC	<unknown>	HIDDEN	2
__GI_sysconf	.symtab	0x10010b3c	400	FUNC	<unknown>	HIDDEN	2
__GI_tcgetattr	.symtab	0x1000d760	156	FUNC	<unknown>	HIDDEN	2
__GI_tcsetattr	.symtab	0x1000d7fc	356	FUNC	<unknown>	HIDDEN	2
__GI_time	.symtab	0x1000a910	72	FUNC	<unknown>	HIDDEN	2
__GI_tolower	.symtab	0x100115d8	32	FUNC	<unknown>	HIDDEN	2
__GI_toupper	.symtab	0x1000a9f0	32	FUNC	<unknown>	HIDDEN	2
__GI_vasprintf	.symtab	0x1000adfc	160	FUNC	<unknown>	HIDDEN	2
__GI_vfork	.symtab	0x10011104	16	FUNC	<unknown>	HIDDEN	2
__GI_vfprintf	.symtab	0x1000b6e8	176	FUNC	<unknown>	HIDDEN	2
__GI_vsnprintf	.symtab	0x1000ae9c	204	FUNC	<unknown>	HIDDEN	2
__GI_wait4	.symtab	0x10011590	72	FUNC	<unknown>	HIDDEN	2
__GI_waitpid	.symtab	0x1000a9a0	8	FUNC	<unknown>	HIDDEN	2
__GI_wcrtomb	.symtab	0x10011604	92	FUNC	<unknown>	HIDDEN	2
__GI_wcsnrtombs	.symtab	0x10011670	204	FUNC	<unknown>	HIDDEN	2
__GI_wcsrtombs	.symtab	0x10011660	16	FUNC	<unknown>	HIDDEN	2
__GI_write	.symtab	0x1000a9a8	72	FUNC	<unknown>	HIDDEN	2
__JCR_END__	.symtab	0x1002b010	0	OBJECT	<unknown>	DEFAULT	8
__JCR_LIST__	.symtab	0x1002b010	0	OBJECT	<unknown>	DEFAULT	8
__app_fini	.symtab	0x1002be14	4	OBJECT	<unknown>	HIDDEN	11
__atexit_lock	.symtab	0x1002bccc	24	OBJECT	<unknown>	DEFAULT	9
__bsd_signal	.symtab	0x100143f4	224	FUNC	<unknown>	HIDDEN	2
__bss_start	.symtab	0x1002bd98	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
__check_one_fd	.symtab	0x10010db8	96	FUNC	<unknown>	DEFAULT	2
__ctype_b	.symtab	0x1002bd8c	4	OBJECT	<unknown>	DEFAULT	10
__ctype_tolower	.symtab	0x1002bd94	4	OBJECT	<unknown>	DEFAULT	10
__ctype_toupper	.symtab	0x1002bd60	4	OBJECT	<unknown>	DEFAULT	10
__curbrk	.symtab	0x1002be4c	4	OBJECT	<unknown>	DEFAULT	11
__data_start	.symtab	0x1002b020	0	NOTYPE	<unknown>	DEFAULT	9
__decode_answer	.symtab	0x10015004	272	FUNC	<unknown>	HIDDEN	2
__decode_dotted	.symtab	0x10013428	244	FUNC	<unknown>	HIDDEN	2
__decode_header	.symtab	0x10014e98	196	FUNC	<unknown>	HIDDEN	2
__deregister_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__dns_lookup	.symtab	0x1001351c	1692	FUNC	<unknown>	HIDDEN	2
__do_global_ctors_aux	.symtab	0x100156a0	0	FUNC	<unknown>	DEFAULT	2
__do_global_dtors_aux	.symtab	0x100000b8	0	FUNC	<unknown>	DEFAULT	2
__dso_handle	.symtab	0x1002b018	0	OBJECT	<unknown>	HIDDEN	9
__encode_dotted	.symtab	0x1001558c	204	FUNC	<unknown>	HIDDEN	2
__encode_header	.symtab	0x10014dac	236	FUNC	<unknown>	HIDDEN	2
__encode_question	.symtab	0x10014f5c	124	FUNC	<unknown>	HIDDEN	2
__environ	.symtab	0x1002be0c	4	OBJECT	<unknown>	DEFAULT	11
__errno_location	.symtab	0x1000aa10	12	FUNC	<unknown>	DEFAULT	2
__errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__exit_cleanup	.symtab	0x1002be04	4	OBJECT	<unknown>	HIDDEN	11
__fgetc_unlocked	.symtab	0x1001235c	312	FUNC	<unknown>	DEFAULT	2
__fini_array_end	.symtab	0x1002b000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fini_array_start	.symtab	0x1002b000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__fputc_unlocked	.symtab	0x1000cde4	292	FUNC	<unknown>	DEFAULT	2
__get_hosts_byaddr_r	.symtab	0x10013ee4	172	FUNC	<unknown>	HIDDEN	2
__get_hosts_byname_r	.symtab	0x10013e8c	88	FUNC	<unknown>	HIDDEN	2
__getpagesize	.symtab	0x1000a6fc	28	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r	.symtab	0x1000d4d8	48	FUNC	<unknown>	DEFAULT	2
__glibc_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__h_errno_location	.symtab	0x100115f8	12	FUNC	<unknown>	DEFAULT	2
__h_errno_location.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__heap_alloc	.symtab	0x1000fca4	160	FUNC	<unknown>	DEFAULT	2
__heap_alloc_at	.symtab	0x1000fd44	156	FUNC	<unknown>	DEFAULT	2
__heap_free	.symtab	0x1000fe28	300	FUNC	<unknown>	DEFAULT	2
__heap_link_free_area	.symtab	0x1000fde0	44	FUNC	<unknown>	DEFAULT	2
__heap_link_free_area_after	.symtab	0x1000fe0c	28	FUNC	<unknown>	DEFAULT	2
__init_array_end	.symtab	0x1002b000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__init_array_start	.symtab	0x1002b000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__initbuf	.symtab	0x10012944	76	FUNC	<unknown>	DEFAULT	2
__length_dotted	.symtab	0x10015658	72	FUNC	<unknown>	HIDDEN	2
__length_question	.symtab	0x10014fd8	44	FUNC	<unknown>	HIDDEN	2
__libc_accept	.symtab	0x1000f6f4	52	FUNC	<unknown>	DEFAULT	2
__libc_close	.symtab	0x1000a534	72	FUNC	<unknown>	DEFAULT	2
__libc_connect	.symtab	0x1000f75c	52	FUNC	<unknown>	DEFAULT	2
__libc_creat	.symtab	0x10011450	16	FUNC	<unknown>	DEFAULT	2
__libc_fcntl	.symtab	0x1000a404	132	FUNC	<unknown>	DEFAULT	2
__libc_fcntl64	.symtab	0x1000a488	100	FUNC	<unknown>	DEFAULT	2
__libc_fork	.symtab	0x1000a57c	72	FUNC	<unknown>	DEFAULT	2
__libc_getpid	.symtab	0x1000a718	72	FUNC	<unknown>	DEFAULT	2
__libc_lseek64	.symtab	0x100154c4	128	FUNC	<unknown>	DEFAULT	2
__libc_nanosleep	.symtab	0x10011390	72	FUNC	<unknown>	DEFAULT	2
__libc_open	.symtab	0x100113d8	120	FUNC	<unknown>	DEFAULT	2
__libc_poll	.symtab	0x1000a838	72	FUNC	<unknown>	DEFAULT	2
__libc_read	.symtab	0x10015544	72	FUNC	<unknown>	DEFAULT	2
__libc_recv	.symtab	0x1000f7fc	56	FUNC	<unknown>	DEFAULT	2
__libc_select	.symtab	0x1000a880	72	FUNC	<unknown>	DEFAULT	2
__libc_send	.symtab	0x1000f834	56	FUNC	<unknown>	DEFAULT	2
__libc_sendto	.symtab	0x1000f86c	64	FUNC	<unknown>	DEFAULT	2
__libc_sigaction	.symtab	0x10014330	196	FUNC	<unknown>	DEFAULT	2
__libc_stack_end	.symtab	0x1002be08	4	OBJECT	<unknown>	DEFAULT	11
__libc_system	.symtab	0x1001048c	340	FUNC	<unknown>	DEFAULT	2
__libc_waitpid	.symtab	0x1000a9a0	8	FUNC	<unknown>	DEFAULT	2
__libc_write	.symtab	0x1000a9a8	72	FUNC	<unknown>	DEFAULT	2
__malloc_heap	.symtab	0x1002bd80	4	OBJECT	<unknown>	DEFAULT	10
__malloc_heap_lock	.symtab	0x10032294	24	OBJECT	<unknown>	DEFAULT	12
__malloc_sbrk_lock	.symtab	0x100334d4	24	OBJECT	<unknown>	DEFAULT	12
__nameserver	.symtab	0x100334fc	12	OBJECT	<unknown>	HIDDEN	12
__nameservers	.symtab	0x1002be38	4	OBJECT	<unknown>	HIDDEN	11
__open_etc_hosts	.symtab	0x10015114	100	FUNC	<unknown>	HIDDEN	2
__open_nameservers	.symtab	0x10013bb8	724	FUNC	<unknown>	HIDDEN	2
__opensock	.symtab	0x100142d4	92	FUNC	<unknown>	HIDDEN	2
__pagesize	.symtab	0x1002be10	4	OBJECT	<unknown>	DEFAULT	11
__preinit_array_end	.symtab	0x1002b000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__preinit_array_start	.symtab	0x1002b000	0	NOTYPE	<unknown>	HIDDEN	SHN_ABS
__pthread_initialize_minimal	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__pthread_mutex_init	.symtab	0x10010dac	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_lock	.symtab	0x10010dac	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_trylock	.symtab	0x10010dac	8	FUNC	<unknown>	DEFAULT	2
__pthread_mutex_unlock	.symtab	0x10010dac	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_0	.symtab	0x10010dac	8	FUNC	<unknown>	DEFAULT	2
__pthread_return_void	.symtab	0x10010db4	4	FUNC	<unknown>	DEFAULT	2
__raise	.symtab	0x10015494	48	FUNC	<unknown>	HIDDEN	2
__read_etc_hosts_r	.symtab	0x10015178	796	FUNC	<unknown>	HIDDEN	2
__register_frame_info	.symtab	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__resolv_lock	.symtab	0x1002bd00	24	OBJECT	<unknown>	DEFAULT	9
__rtld_fini	.symtab	0x1002be18	4	OBJECT	<unknown>	HIDDEN	11
__searchdomain	.symtab	0x100334ec	16	OBJECT	<unknown>	HIDDEN	12
__searchdomains	.symtab	0x1002be3c	4	OBJECT	<unknown>	HIDDEN	11
__sigaddset	.symtab	0x100144fc	40	FUNC	<unknown>	DEFAULT	2
__sigdelset	.symtab	0x10014524	40	FUNC	<unknown>	DEFAULT	2
__sigismember	.symtab	0x100144d4	40	FUNC	<unknown>	DEFAULT	2
__socketcall	.symtab	0x10011114	72	FUNC	<unknown>	HIDDEN	2
__socketcall.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__stdin	.symtab	0x1002bd70	4	OBJECT	<unknown>	DEFAULT	10
__stdio_READ	.symtab	0x10014924	116	FUNC	<unknown>	HIDDEN	2
__stdio_WRITE	.symtab	0x100117a0	224	FUNC	<unknown>	HIDDEN	2
__stdio_adjust_position	.symtab	0x10014998	252	FUNC	<unknown>	HIDDEN	2
__stdio_fwrite	.symtab	0x10011880	364	FUNC	<unknown>	HIDDEN	2
__stdio_init_mutex	.symtab	0x1000b5c8	16	FUNC	<unknown>	HIDDEN	2
__stdio_mutex_initializer.3862	.symtab	0x100198d4	24	OBJECT	<unknown>	DEFAULT	4
__stdio_rfill	.symtab	0x10014a94	72	FUNC	<unknown>	HIDDEN	2
__stdio_seek	.symtab	0x10014b80	88	FUNC	<unknown>	HIDDEN	2
__stdio_trans2r_o	.symtab	0x10014adc	164	FUNC	<unknown>	HIDDEN	2
__stdio_trans2w_o	.symtab	0x100119ec	248	FUNC	<unknown>	HIDDEN	2
__stdio_wcommit	.symtab	0x1000b698	80	FUNC	<unknown>	HIDDEN	2
__stdout	.symtab	0x1002bd74	4	OBJECT	<unknown>	DEFAULT	10
__syscall_error	.symtab	0x100146b8	52	FUNC	<unknown>	HIDDEN	2
__syscall_error.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_fcntl64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__syscall_rt_sigaction	.symtab	0x10014720	72	FUNC	<unknown>	HIDDEN	2
__syscall_rt_sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uClibc_fini	.symtab	0x10010d18	148	FUNC	<unknown>	DEFAULT	2
__uClibc_init	.symtab	0x10010e18	128	FUNC	<unknown>	DEFAULT	2
__uClibc_main	.symtab	0x10010e98	620	FUNC	<unknown>	DEFAULT	2
__uClibc_main.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
__uclibc_progname	.symtab	0x1002bd84	4	OBJECT	<unknown>	HIDDEN	10
__vfork	.symtab	0x10011104	16	FUNC	<unknown>	HIDDEN	2
__xpg_strerror_r	.symtab	0x1000d508	268	FUNC	<unknown>	DEFAULT	2
__xpg_strerror_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_adjust_pos.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_charpad	.symtab	0x1000b798	96	FUNC	<unknown>	DEFAULT	2
_cs_funcs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_dl_aux_init	.symtab	0x1001469c	28	FUNC	<unknown>	DEFAULT	2
_dl_phdr	.symtab	0x1002be44	4	OBJECT	<unknown>	DEFAULT	11
_dl_phnum	.symtab	0x1002be48	4	OBJECT	<unknown>	DEFAULT	11
_edata	.symtab	0x1002bd98	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_end	.symtab	0x10033588	0	NOTYPE	<unknown>	DEFAULT	SHN_ABS
_errno	.symtab	0x1002be20	4	OBJECT	<unknown>	DEFAULT	11
_exit	.symtab	0x1001115c	60	FUNC	<unknown>	DEFAULT	2
_exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fini	.symtab	0x1001570c	16	FUNC	<unknown>	DEFAULT	3
_fixed_buffers	.symtab	0x10030284	8192	OBJECT	<unknown>	DEFAULT	12
_fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fp_out_narrow	.symtab	0x1000b7f8	160	FUNC	<unknown>	DEFAULT	2
_fpmaxtostr	.symtab	0x10011c98	1732	FUNC	<unknown>	HIDDEN	2
_fpmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_fwrite.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_h_errno	.symtab	0x1002be24	4	OBJECT	<unknown>	DEFAULT	11
_init	.symtab	0x10000094	16	FUNC	<unknown>	DEFAULT	1
_load_inttype	.symtab	0x10011ae4	128	FUNC	<unknown>	HIDDEN	2
_load_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_init	.symtab	0x1000bf08	188	FUNC	<unknown>	HIDDEN	2
_ppfs_init.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_parsespec	.symtab	0x1000c2d0	1304	FUNC	<unknown>	HIDDEN	2
_ppfs_parsespec.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_prepargs	.symtab	0x1000bfc4	92	FUNC	<unknown>	HIDDEN	2
_ppfs_prepargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_ppfs_setargs	.symtab	0x1000c020	624	FUNC	<unknown>	HIDDEN	2
_ppfs_setargs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_promoted_size	.symtab	0x1000c290	64	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_pop_restore	.symtab	0x10010db4	4	FUNC	<unknown>	DEFAULT	2
_pthread_cleanup_push_defer	.symtab	0x10010db4	4	FUNC	<unknown>	DEFAULT	2
_rfill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_sigintr	.symtab	0x10033508	128	OBJECT	<unknown>	HIDDEN	12
_start	.symtab	0x100001f0	72	FUNC	<unknown>	DEFAULT	2
_stdio.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_stdio_fopen	.symtab	0x1000b298	700	FUNC	<unknown>	HIDDEN	2
_stdio_init	.symtab	0x1000b554	116	FUNC	<unknown>	HIDDEN	2
_stdio_openlist	.symtab	0x1002bd78	4	OBJECT	<unknown>	DEFAULT	10
_stdio_openlist_add_lock	.symtab	0x1002b9ec	24	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_dec_use	.symtab	0x1000ca50	288	FUNC	<unknown>	DEFAULT	2
_stdio_openlist_del_count	.symtab	0x1002bdfc	4	OBJECT	<unknown>	DEFAULT	11
_stdio_openlist_del_lock	.symtab	0x1002ba04	24	OBJECT	<unknown>	DEFAULT	9
_stdio_openlist_use_count	.symtab	0x1002bdf8	4	OBJECT	<unknown>	DEFAULT	11
_stdio_streams	.symtab	0x1002ba1c	240	OBJECT	<unknown>	DEFAULT	9
_stdio_term	.symtab	0x1000b5d8	192	FUNC	<unknown>	HIDDEN	2
_stdio_user_locking	.symtab	0x1002bd7c	4	OBJECT	<unknown>	DEFAULT	10
_stdlib_strto_l	.symtab	0x100105fc	436	FUNC	<unknown>	HIDDEN	2
_stdlib_strto_l.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_store_inttype	.symtab	0x10011b64	60	FUNC	<unknown>	HIDDEN	2
_store_inttype.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_string_syserrmsgs	.symtab	0x100199a4	2906	OBJECT	<unknown>	HIDDEN	4
_string_syserrmsgs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_trans2w.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_uintmaxtostr	.symtab	0x10011ba0	248	FUNC	<unknown>	HIDDEN	2
_uintmaxtostr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_vfprintf_internal	.symtab	0x1000b898	1648	FUNC	<unknown>	HIDDEN	2
_vfprintf_internal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
_wcommit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
abort	.symtab	0x1001454c	336	FUNC	<unknown>	DEFAULT	2
abort.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
accept	.symtab	0x1000f6f4	52	FUNC	<unknown>	DEFAULT	2
accept.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
actualparent	.symtab	0x1002bdc8	4	OBJECT	<unknown>	DEFAULT	11
advance_telstate	.symtab	0x10005ef8	136	FUNC	<unknown>	DEFAULT	2
advances	.symtab	0x1002b868	28	OBJECT	<unknown>	DEFAULT	9
advances2	.symtab	0x1002b8c8	44	OBJECT	<unknown>	DEFAULT	9
ak47scan	.symtab	0x10007540	276	FUNC	<unknown>	DEFAULT	2
ak47scantoggle	.symtab	0x10007654	496	FUNC	<unknown>	DEFAULT	2
ak47telscan	.symtab	0x10006028	5400	FUNC	<unknown>	DEFAULT	2
append	.symtab	0x10008004	100	FUNC	<unknown>	DEFAULT	2
asprintf	.symtab	0x1000acf0	128	FUNC	<unknown>	DEFAULT	2
asprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
atoi	.symtab	0x100105e0	12	FUNC	<unknown>	DEFAULT	2
atol	.symtab	0x100105e0	12	FUNC	<unknown>	DEFAULT	2
atol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
bcopy	.symtab	0x1000d614	16	FUNC	<unknown>	DEFAULT	2
bcopy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
been_there_done_that	.symtab	0x1002be40	4	OBJECT	<unknown>	DEFAULT	11
been_there_done_that.2829	.symtab	0x1002be1c	4	OBJECT	<unknown>	DEFAULT	11
bind	.symtab	0x1000f728	52	FUNC	<unknown>	DEFAULT	2
bind.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
blacknurse	.symtab	0x10001e1c	804	FUNC	<unknown>	DEFAULT	2
botkill	.symtab	0x10007844	200	FUNC	<unknown>	DEFAULT	2
brk	.symtab	0x100146ec	52	FUNC	<unknown>	DEFAULT	2
bsd_signal	.symtab	0x100143f4	224	FUNC	<unknown>	DEFAULT	2
buf.2641	.symtab	0x10032284	16	OBJECT	<unknown>	DEFAULT	12
c	.symtab	0x1002b8f4	4	OBJECT	<unknown>	DEFAULT	9
call___do_global_ctors_aux	.symtab	0x100156f0	0	FUNC	<unknown>	DEFAULT	2
call___do_global_dtors_aux	.symtab	0x1000014c	0	FUNC	<unknown>	DEFAULT	2
call_frame_dummy	.symtab	0x100001d4	0	FUNC	<unknown>	DEFAULT	2
capsaicin2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
chan	.symtab	0x1002bdec	4	OBJECT	<unknown>	DEFAULT	11
changeservers	.symtab	0x1002bd9c	4	OBJECT	<unknown>	DEFAULT	11
chdir	.symtab	0x1000a4ec	72	FUNC	<unknown>	DEFAULT	2
chdir.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
clock_getres	.symtab	0x10011198	72	FUNC	<unknown>	DEFAULT	2
clock_getres.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
close	.symtab	0x1000a534	72	FUNC	<unknown>	DEFAULT	2
close.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
completed.3069	.symtab	0x1002be50	1	OBJECT	<unknown>	DEFAULT	12
con	.symtab	0x100093f8	852	FUNC	<unknown>	DEFAULT	2
connect	.symtab	0x1000f75c	52	FUNC	<unknown>	DEFAULT	2
connect.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
contains_fail	.symtab	0x10005bd4	72	FUNC	<unknown>	DEFAULT	2
contains_response	.symtab	0x10005c1c	116	FUNC	<unknown>	DEFAULT	2
contains_string	.symtab	0x10005a9c	240	FUNC	<unknown>	DEFAULT	2
contains_success	.symtab	0x10005b8c	72	FUNC	<unknown>	DEFAULT	2
creat	.symtab	0x10011450	16	FUNC	<unknown>	DEFAULT	2
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
crtstuff.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
csum	.symtab	0x10000260	236	FUNC	<unknown>	DEFAULT	2
data_start	.symtab	0x1002b020	0	NOTYPE	<unknown>	DEFAULT	9
decodea.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
decodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
disable	.symtab	0x10001844	372	FUNC	<unknown>	DEFAULT	2
disabled	.symtab	0x1002bda0	1	OBJECT	<unknown>	DEFAULT	11
dispass	.symtab	0x100322d4	256	OBJECT	<unknown>	DEFAULT	12
dl-support.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
dns	.symtab	0x10004548	768	FUNC	<unknown>	DEFAULT	2
dns_format	.symtab	0x10003d40	340	FUNC	<unknown>	DEFAULT	2
dns_hdr_create	.symtab	0x10003e94	156	FUNC	<unknown>	DEFAULT	2
dns_send	.symtab	0x10003f30	1040	FUNC	<unknown>	DEFAULT	2
dnsflood	.symtab	0x10004340	520	FUNC	<unknown>	DEFAULT	2
dnslookup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
download	.symtab	0x10000f8c	1288	FUNC	<unknown>	DEFAULT	2
dup2	.symtab	0x100111e0	72	FUNC	<unknown>	DEFAULT	2
dup2.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
enable	.symtab	0x100019b8	328	FUNC	<unknown>	DEFAULT	2
encoded.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeh.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
encodeq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
endservent	.symtab	0x10012c10	128	FUNC	<unknown>	DEFAULT	2
environ	.symtab	0x1002be0c	4	OBJECT	<unknown>	DEFAULT	11
errno	.symtab	0x1002be20	4	OBJECT	<unknown>	DEFAULT	11
errno.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execfile	.symtab	0x100323d4	256	OBJECT	<unknown>	DEFAULT	12
execl	.symtab	0x10010834	308	FUNC	<unknown>	DEFAULT	2
execl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
execve	.symtab	0x10011228	72	FUNC	<unknown>	DEFAULT	2
execve.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exit	.symtab	0x100107b0	132	FUNC	<unknown>	DEFAULT	2
exit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
exp10_table	.symtab	0x1001ae88	72	OBJECT	<unknown>	DEFAULT	4
fails	.symtab	0x1002b884	36	OBJECT	<unknown>	DEFAULT	9
fastflux	.symtab	0x100082e4	508	FUNC	<unknown>	DEFAULT	2
fclose	.symtab	0x1000aa1c	332	FUNC	<unknown>	DEFAULT	2
fclose.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fcntl	.symtab	0x1000a404	132	FUNC	<unknown>	DEFAULT	2
fcntl64	.symtab	0x1000a488	100	FUNC	<unknown>	DEFAULT	2
fdopen	.symtab	0x1001173c	100	FUNC	<unknown>	DEFAULT	2
fdopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
feof	.symtab	0x1000c7e8	124	FUNC	<unknown>	DEFAULT	2
feof.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fflush_unlocked	.symtab	0x1000cb70	432	FUNC	<unknown>	DEFAULT	2
fflush_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgetc_unlocked	.symtab	0x1001235c	312	FUNC	<unknown>	DEFAULT	2
fgetc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets	.symtab	0x1000c864	148	FUNC	<unknown>	DEFAULT	2
fgets.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fgets_unlocked	.symtab	0x1000cd20	196	FUNC	<unknown>	DEFAULT	2
fgets_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
filter	.symtab	0x10000780	176	FUNC	<unknown>	DEFAULT	2
flooders	.symtab	0x1002b8fc	176	OBJECT	<unknown>	DEFAULT	9
fmt	.symtab	0x1001ae70	20	OBJECT	<unknown>	DEFAULT	4
fopen	.symtab	0x1000ab68	12	FUNC	<unknown>	DEFAULT	2
fopen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fork	.symtab	0x1000a57c	72	FUNC	<unknown>	DEFAULT	2
fork.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fprintf	.symtab	0x1000ac70	128	FUNC	<unknown>	DEFAULT	2
fprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputc	.symtab	0x1000c8f8	204	FUNC	<unknown>	DEFAULT	2
fputc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputc_unlocked	.symtab	0x1000cde4	292	FUNC	<unknown>	DEFAULT	2
fputc_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs	.symtab	0x1000c9c4	140	FUNC	<unknown>	DEFAULT	2
fputs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fputs_unlocked	.symtab	0x1000cf08	92	FUNC	<unknown>	DEFAULT	2
fputs_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
frame_dummy	.symtab	0x10000168	0	FUNC	<unknown>	DEFAULT	2
free	.symtab	0x1000fa74	256	FUNC	<unknown>	DEFAULT	2
free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
freeaddrinfo	.symtab	0x1000e5dc	64	FUNC	<unknown>	DEFAULT	2
fseek	.symtab	0x10014768	16	FUNC	<unknown>	DEFAULT	2
fseeko	.symtab	0x10014768	16	FUNC	<unknown>	DEFAULT	2
fseeko.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fseeko64	.symtab	0x10014808	284	FUNC	<unknown>	DEFAULT	2
fseeko64.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
fwrite_unlocked	.symtab	0x1000cf64	184	FUNC	<unknown>	DEFAULT	2
fwrite_unlocked.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gaih	.symtab	0x1001a500	24	OBJECT	<unknown>	DEFAULT	4
gaih_inet	.symtab	0x1000da58	2948	FUNC	<unknown>	DEFAULT	2
gaih_inet_serv	.symtab	0x1000d970	232	FUNC	<unknown>	DEFAULT	2
gaih_inet_typeproto	.symtab	0x1001a518	35	OBJECT	<unknown>	DEFAULT	4
get	.symtab	0x10001494	356	FUNC	<unknown>	DEFAULT	2
getBuild	.symtab	0x10000238	40	FUNC	<unknown>	DEFAULT	2
getDatIP	.symtab	0x10005338	1460	FUNC	<unknown>	DEFAULT	2
getHost	.symtab	0x10002a4c	124	FUNC	<unknown>	DEFAULT	2
getPublicIP	.symtab	0x10008194	184	FUNC	<unknown>	DEFAULT	2
get_hosts_byaddr_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
get_hosts_byname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
get_telstate_host	.symtab	0x10005ea0	88	FUNC	<unknown>	DEFAULT	2
getaddrinfo	.symtab	0x1000e61c	756	FUNC	<unknown>	DEFAULT	2
getaddrinfo.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getc_unlocked	.symtab	0x1001235c	312	FUNC	<unknown>	DEFAULT	2
getcwd	.symtab	0x1000a5c4	256	FUNC	<unknown>	DEFAULT	2
getcwd.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getdtablesize	.symtab	0x1000a6c4	56	FUNC	<unknown>	DEFAULT	2
getdtablesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getegid	.symtab	0x10011270	72	FUNC	<unknown>	DEFAULT	2
getegid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
geteuid	.symtab	0x100112b8	72	FUNC	<unknown>	DEFAULT	2
geteuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getgid	.symtab	0x10011300	72	FUNC	<unknown>	DEFAULT	2
getgid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyaddr_r	.symtab	0x1000f3bc	824	FUNC	<unknown>	DEFAULT	2
gethostbyaddr_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname2_r	.symtab	0x1000f0e4	728	FUNC	<unknown>	DEFAULT	2
gethostbyname2_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
gethostbyname_r	.symtab	0x10013f90	836	FUNC	<unknown>	DEFAULT	2
gethostbyname_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getmyip	.symtab	0x1000824c	152	FUNC	<unknown>	DEFAULT	2
getpagesize	.symtab	0x1000a6fc	28	FUNC	<unknown>	DEFAULT	2
getpagesize.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getpid	.symtab	0x1000a718	72	FUNC	<unknown>	DEFAULT	2
getpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getppid	.symtab	0x1000a760	72	FUNC	<unknown>	DEFAULT	2
getppid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getrlimit	.symtab	0x1000a7a8	72	FUNC	<unknown>	DEFAULT	2
getrlimit.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getservbyname	.symtab	0x10012f88	88	FUNC	<unknown>	DEFAULT	2
getservbyname_r	.symtab	0x10012e6c	284	FUNC	<unknown>	DEFAULT	2
getservbyport	.symtab	0x10012e14	88	FUNC	<unknown>	DEFAULT	2
getservbyport_r	.symtab	0x10012d30	228	FUNC	<unknown>	DEFAULT	2
getservent	.symtab	0x10012bd0	64	FUNC	<unknown>	DEFAULT	2
getservent_r	.symtab	0x10012990	576	FUNC	<unknown>	DEFAULT	2
getservice.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getsockopt	.symtab	0x1000f790	60	FUNC	<unknown>	DEFAULT	2
getsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
getuid	.symtab	0x10011348	72	FUNC	<unknown>	DEFAULT	2
getuid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
h_errno	.symtab	0x1002be24	4	OBJECT	<unknown>	DEFAULT	11
head	.symtab	0x1002bddc	4	OBJECT	<unknown>	DEFAULT	11
heap_alloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
heap_alloc_at.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
heap_free.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
help	.symtab	0x100079f8	1048	FUNC	<unknown>	DEFAULT	2
histClear	.symtab	0x1000813c	88	FUNC	<unknown>	DEFAULT	2
hold	.symtab	0x10003c10	304	FUNC	<unknown>	DEFAULT	2
host2ip	.symtab	0x10001b00	220	FUNC	<unknown>	DEFAULT	2
htonl	.symtab	0x1000d968	4	FUNC	<unknown>	DEFAULT	2
htons	.symtab	0x1000d96c	4	FUNC	<unknown>	DEFAULT	2
i.5503	.symtab	0x1002bdb0	4	OBJECT	<unknown>	DEFAULT	11
i.5545	.symtab	0x1002b8f8	4	OBJECT	<unknown>	DEFAULT	9
ident	.symtab	0x1002bdb8	4	OBJECT	<unknown>	DEFAULT	11
identd	.symtab	0x1000095c	884	FUNC	<unknown>	DEFAULT	2
if_freenameindex	.symtab	0x10013310	88	FUNC	<unknown>	DEFAULT	2
if_index.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
if_indextoname	.symtab	0x10012fe0	172	FUNC	<unknown>	DEFAULT	2
if_nameindex	.symtab	0x10013134	476	FUNC	<unknown>	DEFAULT	2
if_nametoindex	.symtab	0x1001308c	168	FUNC	<unknown>	DEFAULT	2
in6_addr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
in6addr_any	.symtab	0x1001a568	16	OBJECT	<unknown>	DEFAULT	4
in6addr_loopback	.symtab	0x1001a578	16	OBJECT	<unknown>	DEFAULT	4
in_cksum	.symtab	0x10000d60	264	FUNC	<unknown>	DEFAULT	2
index	.symtab	0x10012768	256	FUNC	<unknown>	DEFAULT	2
inet_addr	.symtab	0x1000f0b0	52	FUNC	<unknown>	DEFAULT	2
inet_aton	.symtab	0x10013368	192	FUNC	<unknown>	DEFAULT	2
inet_aton.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_makeaddr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa	.symtab	0x1000f07c	52	FUNC	<unknown>	DEFAULT	2
inet_ntoa.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
inet_ntoa_r	.symtab	0x1000f000	124	FUNC	<unknown>	DEFAULT	2
inet_ntop	.symtab	0x1000ed5c	676	FUNC	<unknown>	DEFAULT	2
inet_ntop4	.symtab	0x1000ebfc	352	FUNC	<unknown>	DEFAULT	2
inet_pton	.symtab	0x1000e9f0	524	FUNC	<unknown>	DEFAULT	2
inet_pton4	.symtab	0x1000e910	224	FUNC	<unknown>	DEFAULT	2
infected	.symtab	0x1002bd4c	8	OBJECT	<unknown>	DEFAULT	10
init_rand	.symtab	0x10001bdc	232	FUNC	<unknown>	DEFAULT	2
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initfini.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
initial_fa	.symtab	0x1002bb10	264	OBJECT	<unknown>	DEFAULT	9
initstate	.symtab	0x10010048	136	FUNC	<unknown>	DEFAULT	2
initstate_r	.symtab	0x100103a4	232	FUNC	<unknown>	DEFAULT	2
ioctl	.symtab	0x1000a31c	232	FUNC	<unknown>	DEFAULT	2
ioctl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
isatty	.symtab	0x1000d734	44	FUNC	<unknown>	DEFAULT	2
isatty.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ismaster	.symtab	0x10008068	212	FUNC	<unknown>	DEFAULT	2
junk	.symtab	0x100034e4	304	FUNC	<unknown>	DEFAULT	2
key	.symtab	0x1002bde4	4	OBJECT	<unknown>	DEFAULT	11
kill	.symtab	0x1000a7f0	72	FUNC	<unknown>	DEFAULT	2
kill.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
killall	.symtab	0x10007e10	340	FUNC	<unknown>	DEFAULT	2
killd	.symtab	0x10007f64	160	FUNC	<unknown>	DEFAULT	2
knownBots	.symtab	0x1002b030	776	OBJECT	<unknown>	DEFAULT	9
legit	.symtab	0x1002bd44	8	OBJECT	<unknown>	DEFAULT	10
lengthd.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lengthq.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/powerpc/brk.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/powerpc/crt1.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/powerpc/crti.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/powerpc/crtn.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
libc/sysdeps/linux/powerpc/vfork.S	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
limiter	.symtab	0x1002bdbc	4	OBJECT	<unknown>	DEFAULT	11
listFork	.symtab	0x10002598	312	FUNC	<unknown>	DEFAULT	2
listen	.symtab	0x1000f7cc	48	FUNC	<unknown>	DEFAULT	2
listen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
llseek.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
lseek64	.symtab	0x100154c4	128	FUNC	<unknown>	DEFAULT	2
main	.symtab	0x100098ac	2672	FUNC	<unknown>	DEFAULT	2
makeFukdString	.symtab	0x1000974c	220	FUNC	<unknown>	DEFAULT	2
makeRandomShit	.symtab	0x10002140	220	FUNC	<unknown>	DEFAULT	2
malloc	.symtab	0x1000f91c	344	FUNC	<unknown>	DEFAULT	2
malloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
masters	.symtab	0x1002b024	12	OBJECT	<unknown>	DEFAULT	9
memchr	.symtab	0x10012538	264	FUNC	<unknown>	DEFAULT	2
memchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memcpy	.symtab	0x1000d01c	156	FUNC	<unknown>	DEFAULT	2
memcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memmove	.symtab	0x10012494	164	FUNC	<unknown>	DEFAULT	2
memmove.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mempcpy	.symtab	0x10012640	52	FUNC	<unknown>	DEFAULT	2
mempcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memrchr	.symtab	0x10012674	244	FUNC	<unknown>	DEFAULT	2
memrchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
memset	.symtab	0x1000d0b8	144	FUNC	<unknown>	DEFAULT	2
memset.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
mfork	.symtab	0x10000604	380	FUNC	<unknown>	DEFAULT	2
move	.symtab	0x1000795c	156	FUNC	<unknown>	DEFAULT	2
msgs	.symtab	0x1002b9ac	64	OBJECT	<unknown>	DEFAULT	9
mygethostbyname	.symtab	0x10000e68	292	FUNC	<unknown>	DEFAULT	2
mylock	.symtab	0x1003026c	24	OBJECT	<unknown>	DEFAULT	12
mylock	.symtab	0x1002bc18	24	OBJECT	<unknown>	DEFAULT	9
mylock	.symtab	0x1002bce4	24	OBJECT	<unknown>	DEFAULT	9
mylock	.symtab	0x100322bc	24	OBJECT	<unknown>	DEFAULT	12
mylock	.symtab	0x1002bd18	24	OBJECT	<unknown>	DEFAULT	9
nanosleep	.symtab	0x10011390	72	FUNC	<unknown>	DEFAULT	2
nanosleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
negotiate	.symtab	0x100058ec	432	FUNC	<unknown>	DEFAULT	2
next_start.1106	.symtab	0x1002be00	4	OBJECT	<unknown>	DEFAULT	11
nick	.symtab	0x1002bdc0	4	OBJECT	<unknown>	DEFAULT	11
nickc	.symtab	0x1000164c	216	FUNC	<unknown>	DEFAULT	2
ntohl	.symtab	0x1000d960	4	FUNC	<unknown>	DEFAULT	2
ntohl.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
ntohs	.symtab	0x1000d964	4	FUNC	<unknown>	DEFAULT	2
ntop.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
nummasters	.symtab	0x1002bd3c	4	OBJECT	<unknown>	DEFAULT	10
numpids	.symtab	0x1002bdac	4	OBJECT	<unknown>	DEFAULT	11
numservers	.symtab	0x1002bd30	4	OBJECT	<unknown>	DEFAULT	10
object.3150	.symtab	0x1002be54	24	OBJECT	<unknown>	DEFAULT	12
open	.symtab	0x100113d8	120	FUNC	<unknown>	DEFAULT	2
open.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opennameservers.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
opensock.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
p.3067	.symtab	0x1002b01c	0	OBJECT	<unknown>	DEFAULT	9
passwords	.symtab	0x1002b618	592	OBJECT	<unknown>	DEFAULT	9
pclose	.symtab	0x1000af68	260	FUNC	<unknown>	DEFAULT	2
perror	.symtab	0x1000ab74	68	FUNC	<unknown>	DEFAULT	2
perror.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
pid	.symtab	0x1002bdb4	4	OBJECT	<unknown>	DEFAULT	11
pids	.symtab	0x1002bdf0	4	OBJECT	<unknown>	DEFAULT	11
pipe	.symtab	0x10011460	72	FUNC	<unknown>	DEFAULT	2
pipe.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
poll	.symtab	0x1000a838	72	FUNC	<unknown>	DEFAULT	2
poll.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
popen	.symtab	0x1000b06c	556	FUNC	<unknown>	DEFAULT	2
popen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
popen_list	.symtab	0x1002bdf4	4	OBJECT	<unknown>	DEFAULT	11
poww	.symtab	0x10000cd0	144	FUNC	<unknown>	DEFAULT	2
pps	.symtab	0x1002bdd4	4	OBJECT	<unknown>	DEFAULT	11
prefix.4074	.symtab	0x100198fc	12	OBJECT	<unknown>	DEFAULT	4
print	.symtab	0x10004c6c	1564	FUNC	<unknown>	DEFAULT	2
printchar	.symtab	0x10004848	128	FUNC	<unknown>	DEFAULT	2
printi	.symtab	0x10004a6c	512	FUNC	<unknown>	DEFAULT	2
prints	.symtab	0x100048c8	420	FUNC	<unknown>	DEFAULT	2
putc	.symtab	0x1000c8f8	204	FUNC	<unknown>	DEFAULT	2
putc_unlocked	.symtab	0x1000cde4	292	FUNC	<unknown>	DEFAULT	2
puts	.symtab	0x1000abb8	168	FUNC	<unknown>	DEFAULT	2
puts.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
qual_chars.4079	.symtab	0x10019910	20	OBJECT	<unknown>	DEFAULT	4
raise	.symtab	0x10015494	48	FUNC	<unknown>	DEFAULT	2
raise.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand	.symtab	0x1000ff54	4	FUNC	<unknown>	DEFAULT	2
rand.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rand_cmwc	.symtab	0x10001cc4	344	FUNC	<unknown>	DEFAULT	2
random	.symtab	0x1000ff58	108	FUNC	<unknown>	DEFAULT	2
random.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
random_poly_info	.symtab	0x1001a5b8	40	OBJECT	<unknown>	DEFAULT	4
random_r	.symtab	0x10010230	144	FUNC	<unknown>	DEFAULT	2
random_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
randstring	.symtab	0x10000830	300	FUNC	<unknown>	DEFAULT	2
randtbl	.symtab	0x1002bc4c	128	OBJECT	<unknown>	DEFAULT	9
rawmemchr	.symtab	0x10014bd8	184	FUNC	<unknown>	DEFAULT	2
rawmemchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read	.symtab	0x10015544	72	FUNC	<unknown>	DEFAULT	2
read.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read_etc_hosts_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
read_until_response	.symtab	0x10005dd0	208	FUNC	<unknown>	DEFAULT	2
read_with_timeout	.symtab	0x10005c90	320	FUNC	<unknown>	DEFAULT	2
realloc	.symtab	0x1000fb74	304	FUNC	<unknown>	DEFAULT	2
realloc.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
realrand	.symtab	0x10001724	140	FUNC	<unknown>	DEFAULT	2
recv	.symtab	0x1000f7fc	56	FUNC	<unknown>	DEFAULT	2
recv.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rekdevice	.symtab	0x1002bd40	4	OBJECT	<unknown>	DEFAULT	10
reset_telstate	.symtab	0x10005f80	72	FUNC	<unknown>	DEFAULT	2
rewind	.symtab	0x10014778	144	FUNC	<unknown>	DEFAULT	2
rewind.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
rnd	.symtab	0x1002bde8	4	OBJECT	<unknown>	DEFAULT	11
rndnick	.symtab	0x100017b0	148	FUNC	<unknown>	DEFAULT	2
rseed	.symtab	0x100324d4	4096	OBJECT	<unknown>	DEFAULT	12
rsi	.symtab	0x1002bdcc	4	OBJECT	<unknown>	DEFAULT	11
sbrk	.symtab	0x100114a8	112	FUNC	<unknown>	DEFAULT	2
sbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
scanPid	.symtab	0x1002bd98	4	OBJECT	<unknown>	DEFAULT	11
sclose	.symtab	0x10005fc8	96	FUNC	<unknown>	DEFAULT	2
select	.symtab	0x1000a880	72	FUNC	<unknown>	DEFAULT	2
select.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
send	.symtab	0x1000f834	56	FUNC	<unknown>	DEFAULT	2
send.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sendHOLD	.symtab	0x10003614	1532	FUNC	<unknown>	DEFAULT	2
sendHTTP	.symtab	0x10002bd4	496	FUNC	<unknown>	DEFAULT	2
sendJUNK	.symtab	0x10002f50	1428	FUNC	<unknown>	DEFAULT	2
sendSTD	.symtab	0x100026d0	892	FUNC	<unknown>	DEFAULT	2
sendto	.symtab	0x1000f86c	64	FUNC	<unknown>	DEFAULT	2
sendto.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
serv	.symtab	0x100322ac	16	OBJECT	<unknown>	DEFAULT	12
serv_stayopen	.symtab	0x1002be30	4	OBJECT	<unknown>	DEFAULT	11
servbuf	.symtab	0x1002be28	4	OBJECT	<unknown>	DEFAULT	11
server	.symtab	0x1002bdd8	4	OBJECT	<unknown>	DEFAULT	11
servers	.symtab	0x1002bd34	8	OBJECT	<unknown>	DEFAULT	10
servf	.symtab	0x1002be2c	4	OBJECT	<unknown>	DEFAULT	11
setservent	.symtab	0x10012c90	160	FUNC	<unknown>	DEFAULT	2
setsid	.symtab	0x1000a8c8	72	FUNC	<unknown>	DEFAULT	2
setsid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setsockopt	.symtab	0x1000f8ac	60	FUNC	<unknown>	DEFAULT	2
setsockopt.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
setstate	.symtab	0x1000ffc4	132	FUNC	<unknown>	DEFAULT	2
setstate_r	.symtab	0x1001013c	244	FUNC	<unknown>	DEFAULT	2
sigaction	.symtab	0x10014330	196	FUNC	<unknown>	DEFAULT	2
sigaction.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
signal	.symtab	0x100143f4	224	FUNC	<unknown>	DEFAULT	2
signal.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigprocmask	.symtab	0x10011518	120	FUNC	<unknown>	DEFAULT	2
sigprocmask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sigsetops.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sleep	.symtab	0x10010968	468	FUNC	<unknown>	DEFAULT	2
sleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
sleeptime	.symtab	0x1002bd54	4	OBJECT	<unknown>	DEFAULT	10
sock	.symtab	0x1002bdc4	4	OBJECT	<unknown>	DEFAULT	11
socket	.symtab	0x1000f8e8	52	FUNC	<unknown>	DEFAULT	2
socket.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
socket_connect	.symtab	0x10002ac8	268	FUNC	<unknown>	DEFAULT	2
spec_and_mask.4078	.symtab	0x10019924	16	OBJECT	<unknown>	DEFAULT	4
spec_base.4073	.symtab	0x10019908	7	OBJECT	<unknown>	DEFAULT	4
spec_chars.4075	.symtab	0x10019950	21	OBJECT	<unknown>	DEFAULT	4
spec_flags.4074	.symtab	0x10019968	8	OBJECT	<unknown>	DEFAULT	4
spec_or_mask.4077	.symtab	0x10019934	16	OBJECT	<unknown>	DEFAULT	4
spec_ranges.4076	.symtab	0x10019944	9	OBJECT	<unknown>	DEFAULT	4
spoofs	.symtab	0x1002bda4	4	OBJECT	<unknown>	DEFAULT	11
spoofsm	.symtab	0x1002bda8	4	OBJECT	<unknown>	DEFAULT	11
sprintf	.symtab	0x1000ad70	140	FUNC	<unknown>	DEFAULT	2
sprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
srand	.symtab	0x100100d0	108	FUNC	<unknown>	DEFAULT	2
srandom	.symtab	0x100100d0	108	FUNC	<unknown>	DEFAULT	2
srandom_r	.symtab	0x100102c0	228	FUNC	<unknown>	DEFAULT	2
static_id	.symtab	0x1002bcfc	2	OBJECT	<unknown>	DEFAULT	9
static_ns	.symtab	0x1002be34	4	OBJECT	<unknown>	DEFAULT	11
stderr	.symtab	0x1002bd6c	4	OBJECT	<unknown>	DEFAULT	10
stdin	.symtab	0x1002bd64	4	OBJECT	<unknown>	DEFAULT	10
stdout	.symtab	0x1002bd68	4	OBJECT	<unknown>	DEFAULT	10
strcasecmp	.symtab	0x1000d624	80	FUNC	<unknown>	DEFAULT	2
strcasecmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcasestr	.symtab	0x1000d674	100	FUNC	<unknown>	DEFAULT	2
strcasestr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strchr	.symtab	0x10012768	256	FUNC	<unknown>	DEFAULT	2
strchr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcmp	.symtab	0x1000d148	52	FUNC	<unknown>	DEFAULT	2
strcmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strcoll	.symtab	0x1000d148	52	FUNC	<unknown>	DEFAULT	2
strcpy	.symtab	0x1000d17c	32	FUNC	<unknown>	DEFAULT	2
strcpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strdup	.symtab	0x1000d6d8	80	FUNC	<unknown>	DEFAULT	2
strdup.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strerror_r	.symtab	0x1000d508	268	FUNC	<unknown>	DEFAULT	2
strlen	.symtab	0x1000d19c	164	FUNC	<unknown>	DEFAULT	2
strlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncat	.symtab	0x10014c90	208	FUNC	<unknown>	DEFAULT	2
strncat.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncmp	.symtab	0x1000d240	236	FUNC	<unknown>	DEFAULT	2
strncmp.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strncpy	.symtab	0x1000d32c	188	FUNC	<unknown>	DEFAULT	2
strncpy.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strnlen	.symtab	0x1000d3e8	240	FUNC	<unknown>	DEFAULT	2
strnlen.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strpbrk	.symtab	0x10012908	60	FUNC	<unknown>	DEFAULT	2
strpbrk.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strspn	.symtab	0x10014d60	76	FUNC	<unknown>	DEFAULT	2
strspn.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok	.symtab	0x1000d728	12	FUNC	<unknown>	DEFAULT	2
strtok.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtok_r	.symtab	0x10012868	160	FUNC	<unknown>	DEFAULT	2
strtok_r.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtol	.symtab	0x100105ec	8	FUNC	<unknown>	DEFAULT	2
strtol.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strtoul	.symtab	0x100105f4	8	FUNC	<unknown>	DEFAULT	2
strtoul.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
strwildmatch	.symtab	0x1000034c	484	FUNC	<unknown>	DEFAULT	2
successes	.symtab	0x1002b8a8	32	OBJECT	<unknown>	DEFAULT	9
sysconf	.symtab	0x10010b3c	400	FUNC	<unknown>	DEFAULT	2
sysconf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
system	.symtab	0x1001048c	340	FUNC	<unknown>	DEFAULT	2
system.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
szprintf	.symtab	0x10005288	176	FUNC	<unknown>	DEFAULT	2
tcgetattr	.symtab	0x1000d760	156	FUNC	<unknown>	DEFAULT	2
tcgetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tcsetattr	.symtab	0x1000d7fc	356	FUNC	<unknown>	DEFAULT	2
tcsetattr.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tehport	.symtab	0x1002bde0	4	OBJECT	<unknown>	DEFAULT	11
textBuffer.4986	.symtab	0x1002be6c	1024	OBJECT	<unknown>	DEFAULT	12
thanks	.symtab	0x1002bd58	4	OBJECT	<unknown>	DEFAULT	10
time	.symtab	0x1000a910	72	FUNC	<unknown>	DEFAULT	2
time.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
tolower	.symtab	0x100115d8	32	FUNC	<unknown>	DEFAULT	2
tolower.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
touchMyself	.symtab	0x10009828	132	FUNC	<unknown>	DEFAULT	2
toupper	.symtab	0x1000a9f0	32	FUNC	<unknown>	DEFAULT	2
toupper.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
type_codes	.symtab	0x10019970	24	OBJECT	<unknown>	DEFAULT	4
type_sizes	.symtab	0x10019988	12	OBJECT	<unknown>	DEFAULT	4
umask	.symtab	0x1000a958	72	FUNC	<unknown>	DEFAULT	2
umask.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
unknown	.symtab	0x1000221c	892	FUNC	<unknown>	DEFAULT	2
unknown.1128	.symtab	0x10019994	14	OBJECT	<unknown>	DEFAULT	4
unsafe_state	.symtab	0x1002bc30	28	OBJECT	<unknown>	DEFAULT	9
user	.symtab	0x1002bdd0	4	OBJECT	<unknown>	DEFAULT	11
usernames	.symtab	0x1002b3c8	592	OBJECT	<unknown>	DEFAULT	9
usleep	.symtab	0x10010ccc	76	FUNC	<unknown>	DEFAULT	2
usleep.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
vasprintf	.symtab	0x1000adfc	160	FUNC	<unknown>	DEFAULT	2
vasprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
version	.symtab	0x100015f8	84	FUNC	<unknown>	DEFAULT	2
vfork	.symtab	0x10011104	16	FUNC	<unknown>	DEFAULT	2
vfprintf	.symtab	0x1000b6e8	176	FUNC	<unknown>	DEFAULT	2
vfprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
vsnprintf	.symtab	0x1000ae9c	204	FUNC	<unknown>	DEFAULT	2
vsnprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
vsprintf	.symtab	0x1000ac60	16	FUNC	<unknown>	DEFAULT	2
vsprintf.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wait4	.symtab	0x10011590	72	FUNC	<unknown>	DEFAULT	2
wait4.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
waitpid	.symtab	0x1000a9a0	8	FUNC	<unknown>	DEFAULT	2
waitpid.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcrtomb	.symtab	0x10011604	92	FUNC	<unknown>	DEFAULT	2
wcrtomb.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsnrtombs	.symtab	0x10011670	204	FUNC	<unknown>	DEFAULT	2
wcsnrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
wcsrtombs	.symtab	0x10011660	16	FUNC	<unknown>	DEFAULT	2
wcsrtombs.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
write	.symtab	0x1000a9a8	72	FUNC	<unknown>	DEFAULT	2
write.c	.symtab	0x0	0	FILE	<unknown>	DEFAULT	SHN_ABS
xdigits.3080	.symtab	0x1001a550	17	OBJECT	<unknown>	DEFAULT	4

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 28, 2024 12:36:51.137561083 CET	43928	443	192.168.2.23	91.189.91.42
Dec 28, 2024 12:36:56.512865067 CET	42836	443	192.168.2.23	91.189.91.43
Dec 28, 2024 12:36:58.048592091 CET	42516	80	192.168.2.23	109.202.202.202
Dec 28, 2024 12:37:11.358773947 CET	43928	443	192.168.2.23	91.189.91.42
Dec 28, 2024 12:37:23.645051003 CET	42836	443	192.168.2.23	91.189.91.43
Dec 28, 2024 12:37:27.740407944 CET	42516	80	192.168.2.23	109.202.202.202
Dec 28, 2024 12:37:52.312978983 CET	43928	443	192.168.2.23	91.189.91.42

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 28, 2024 12:36:48.768762112 CET	48143	53	192.168.2.23	1.1.1.1
Dec 28, 2024 12:36:49.440880060 CET	53	48143	1.1.1.1	192.168.2.23

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 28, 2024 12:36:48.768762112 CET	192.168.2.23	1.1.1.1	0xd317	Standard query (0)	pirati.privatedns.org	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 28, 2024 12:36:49.440880060 CET	1.1.1.1	192.168.2.23	0xd317	No error (0)	pirati.privatedns.org		212.171.15.94	A (IP address)	IN (0x0001)	false

System Behavior

Analysis Process: yakuza.ppc.elf PID: 6234, Parent PID: 6156

General

Start time (UTC):	11:36:47
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	/tmp/yakuza.ppc.elf
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: yakuza.ppc.elf PID: 6236, Parent PID: 6234

General

Start time (UTC):	11:36:47
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: yakuza.ppc.elf PID: 6242, Parent PID: 6236

General

Start time (UTC):	11:36:47
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: yakuza.ppc.elf PID: 6243, Parent PID: 6236

General

Start time (UTC):	11:36:47
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: yakuza.ppc.elf PID: 6246, Parent PID: 6236

General

Start time (UTC):	11:36:47
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: sh PID: 6246, Parent PID: 6236

General

Start time (UTC):	11:36:47
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 902i13 \|\| busybox pkill -9 902i13"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6251, Parent PID: 6246

General

Start time (UTC):	11:36:47
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 6251, Parent PID: 6246

General

Start time (UTC):	11:36:47
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 902i13
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 6266, Parent PID: 6246

General

Start time (UTC):	11:36:49
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 6266, Parent PID: 6246

General

Start time (UTC):	11:36:49
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 902i13
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.ppc.elf PID: 6267, Parent PID: 6236

General

Start time (UTC):	11:36:50
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: sh PID: 6267, Parent PID: 6236

General

Start time (UTC):	11:36:50
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 BzSxLxBxeY \|\| busybox pkill -9 BzSxLxBxeY"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6272, Parent PID: 6267

General

Start time (UTC):	11:36:51
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 6272, Parent PID: 6267

General

Start time (UTC):	11:36:51
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 BzSxLxBxeY
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 6279, Parent PID: 6267

General

Start time (UTC):	11:36:52
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 6279, Parent PID: 6267

General

Start time (UTC):	11:36:52
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 BzSxLxBxeY
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.ppc.elf PID: 6280, Parent PID: 6236

General

Start time (UTC):	11:36:53
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: sh PID: 6280, Parent PID: 6236

General

Start time (UTC):	11:36:53
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 HOHO-LUGO7 \|\| busybox pkill -9 HOHO-LUGO7"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6282, Parent PID: 6280

General

Start time (UTC):	11:36:53
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 6282, Parent PID: 6280

General

Start time (UTC):	11:36:53
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 HOHO-LUGO7
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 6285, Parent PID: 6280

General

Start time (UTC):	11:36:54
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 6285, Parent PID: 6280

General

Start time (UTC):	11:36:54
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 HOHO-LUGO7
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.ppc.elf PID: 6286, Parent PID: 6236

General

Start time (UTC):	11:36:55
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: sh PID: 6286, Parent PID: 6236

General

Start time (UTC):	11:36:55
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 HOHO-U79OL \|\| busybox pkill -9 HOHO-U79OL"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6288, Parent PID: 6286

General

Start time (UTC):	11:36:55
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 6288, Parent PID: 6286

General

Start time (UTC):	11:36:55
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 HOHO-U79OL
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 6289, Parent PID: 6286

General

Start time (UTC):	11:36:57
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 6289, Parent PID: 6286

General

Start time (UTC):	11:36:57
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 HOHO-U79OL
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.ppc.elf PID: 6290, Parent PID: 6236

General

Start time (UTC):	11:36:58
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: sh PID: 6290, Parent PID: 6236

General

Start time (UTC):	11:36:58
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 JuYfouyf87 \|\| busybox pkill -9 JuYfouyf87"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6295, Parent PID: 6290

General

Start time (UTC):	11:36:58
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 6295, Parent PID: 6290

General

Start time (UTC):	11:36:58
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 JuYfouyf87
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 6296, Parent PID: 6290

General

Start time (UTC):	11:36:59
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 6296, Parent PID: 6290

General

Start time (UTC):	11:36:59
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 JuYfouyf87
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.ppc.elf PID: 6299, Parent PID: 6236

General

Start time (UTC):	11:37:00
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: sh PID: 6299, Parent PID: 6236

General

Start time (UTC):	11:37:00
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 NiGGeR69xd \|\| busybox pkill -9 NiGGeR69xd"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6304, Parent PID: 6299

General

Start time (UTC):	11:37:00
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 6304, Parent PID: 6299

General

Start time (UTC):	11:37:00
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 NiGGeR69xd
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 6305, Parent PID: 6299

General

Start time (UTC):	11:37:01
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 6305, Parent PID: 6299

General

Start time (UTC):	11:37:01
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 NiGGeR69xd
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.ppc.elf PID: 6307, Parent PID: 6236

General

Start time (UTC):	11:37:02
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: sh PID: 6307, Parent PID: 6236

General

Start time (UTC):	11:37:02
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 SO190Ij1X \|\| busybox pkill -9 SO190Ij1X"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6312, Parent PID: 6307

General

Start time (UTC):	11:37:02
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 6312, Parent PID: 6307

General

Start time (UTC):	11:37:02
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 SO190Ij1X
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 6313, Parent PID: 6307

General

Start time (UTC):	11:37:03
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 6313, Parent PID: 6307

General

Start time (UTC):	11:37:03
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 SO190Ij1X
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.ppc.elf PID: 6314, Parent PID: 6236

General

Start time (UTC):	11:37:04
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: sh PID: 6314, Parent PID: 6236

General

Start time (UTC):	11:37:04
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 LOLKIKEEEDDE \|\| busybox pkill -9 LOLKIKEEEDDE"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6320, Parent PID: 6314

General

Start time (UTC):	11:37:04
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 6320, Parent PID: 6314

General

Start time (UTC):	11:37:04
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 LOLKIKEEEDDE
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 6323, Parent PID: 6314

General

Start time (UTC):	11:37:05
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 6323, Parent PID: 6314

General

Start time (UTC):	11:37:05
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 LOLKIKEEEDDE
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.ppc.elf PID: 6324, Parent PID: 6236

General

Start time (UTC):	11:37:06
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: sh PID: 6324, Parent PID: 6236

General

Start time (UTC):	11:37:06
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 ekjheory98e \|\| busybox pkill -9 ekjheory98e"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6329, Parent PID: 6324

General

Start time (UTC):	11:37:06
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 6329, Parent PID: 6324

General

Start time (UTC):	11:37:06
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 ekjheory98e
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 6330, Parent PID: 6324

General

Start time (UTC):	11:37:07
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 6330, Parent PID: 6324

General

Start time (UTC):	11:37:07
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 ekjheory98e
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.ppc.elf PID: 6331, Parent PID: 6236

General

Start time (UTC):	11:37:08
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: sh PID: 6331, Parent PID: 6236

General

Start time (UTC):	11:37:08
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 scansh4 \|\| busybox pkill -9 scansh4"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6333, Parent PID: 6331

General

Start time (UTC):	11:37:08
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 6333, Parent PID: 6331

General

Start time (UTC):	11:37:08
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 scansh4
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 6353, Parent PID: 6331

General

Start time (UTC):	11:37:09
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 6353, Parent PID: 6331

General

Start time (UTC):	11:37:09
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 scansh4
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.ppc.elf PID: 6356, Parent PID: 6236

General

Start time (UTC):	11:37:10
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: sh PID: 6356, Parent PID: 6236

General

Start time (UTC):	11:37:10
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 MDMA \|\| busybox pkill -9 MDMA"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6358, Parent PID: 6356

General

Start time (UTC):	11:37:10
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 6358, Parent PID: 6356

General

Start time (UTC):	11:37:10
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 MDMA
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 6359, Parent PID: 6356

General

Start time (UTC):	11:37:11
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 6359, Parent PID: 6356

General

Start time (UTC):	11:37:11
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 MDMA
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.ppc.elf PID: 6360, Parent PID: 6236

General

Start time (UTC):	11:37:12
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: sh PID: 6360, Parent PID: 6236

General

Start time (UTC):	11:37:12
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 fdevalvex \|\| busybox pkill -9 fdevalvex"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6362, Parent PID: 6360

General

Start time (UTC):	11:37:12
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 6362, Parent PID: 6360

General

Start time (UTC):	11:37:12
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 fdevalvex
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 6363, Parent PID: 6360

General

Start time (UTC):	11:37:13
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 6363, Parent PID: 6360

General

Start time (UTC):	11:37:13
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 fdevalvex
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.ppc.elf PID: 6364, Parent PID: 6236

General

Start time (UTC):	11:37:14
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: sh PID: 6364, Parent PID: 6236

General

Start time (UTC):	11:37:14
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 scanspc \|\| busybox pkill -9 scanspc"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6366, Parent PID: 6364

General

Start time (UTC):	11:37:14
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 6366, Parent PID: 6364

General

Start time (UTC):	11:37:14
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 scanspc
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 6369, Parent PID: 6364

General

Start time (UTC):	11:37:15
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 6369, Parent PID: 6364

General

Start time (UTC):	11:37:15
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 scanspc
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.ppc.elf PID: 6370, Parent PID: 6236

General

Start time (UTC):	11:37:16
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: sh PID: 6370, Parent PID: 6236

General

Start time (UTC):	11:37:16
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 MELTEDNINJAREALZ \|\| busybox pkill -9 MELTEDNINJAREALZ"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6375, Parent PID: 6370

General

Start time (UTC):	11:37:16
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 6375, Parent PID: 6370

General

Start time (UTC):	11:37:16
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 MELTEDNINJAREALZ
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 6376, Parent PID: 6370

General

Start time (UTC):	11:37:17
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 6376, Parent PID: 6370

General

Start time (UTC):	11:37:17
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 MELTEDNINJAREALZ
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.ppc.elf PID: 6377, Parent PID: 6236

General

Start time (UTC):	11:37:18
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: sh PID: 6377, Parent PID: 6236

General

Start time (UTC):	11:37:18
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 flexsonskids \|\| busybox pkill -9 flexsonskids"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6379, Parent PID: 6377

General

Start time (UTC):	11:37:18
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 6379, Parent PID: 6377

General

Start time (UTC):	11:37:18
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 flexsonskids
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 6382, Parent PID: 6377

General

Start time (UTC):	11:37:19
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: busybox PID: 6382, Parent PID: 6377

General

Start time (UTC):	11:37:19
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 flexsonskids
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Chronological Activities

Analysis Process: yakuza.ppc.elf PID: 6383, Parent PID: 6236

General

Start time (UTC):	11:37:20
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Chronological Activities

Analysis Process: sh PID: 6383, Parent PID: 6236

General

Start time (UTC):	11:37:20
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 scanx86 \|\| busybox pkill -9 scanx86"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: sh PID: 6385, Parent PID: 6383

General

Start time (UTC):	11:37:20
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Chronological Activities

Analysis Process: pkill PID: 6385, Parent PID: 6383

General

Start time (UTC):	11:37:20
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 scanx86
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Chronological Activities

Analysis Process: sh PID: 6386, Parent PID: 6383

General

Start time (UTC):	11:37:21
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6386, Parent PID: 6383

General

Start time (UTC):	11:37:21
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 scanx86
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 6387, Parent PID: 6236

General

Start time (UTC):	11:37:22
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 6387, Parent PID: 6236

General

Start time (UTC):	11:37:22
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 MISAKI-U79OL \|\| busybox pkill -9 MISAKI-U79OL"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6389, Parent PID: 6387

General

Start time (UTC):	11:37:22
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6389, Parent PID: 6387

General

Start time (UTC):	11:37:22
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 MISAKI-U79OL
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6390, Parent PID: 6387

General

Start time (UTC):	11:37:23
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6390, Parent PID: 6387

General

Start time (UTC):	11:37:23
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 MISAKI-U79OL
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 6391, Parent PID: 6236

General

Start time (UTC):	11:37:24
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 6391, Parent PID: 6236

General

Start time (UTC):	11:37:24
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 foAxi102kxe \|\| busybox pkill -9 foAxi102kxe"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6397, Parent PID: 6391

General

Start time (UTC):	11:37:24
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6397, Parent PID: 6391

General

Start time (UTC):	11:37:24
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 foAxi102kxe
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6400, Parent PID: 6391

General

Start time (UTC):	11:37:25
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6400, Parent PID: 6391

General

Start time (UTC):	11:37:25
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 foAxi102kxe
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 6401, Parent PID: 6236

General

Start time (UTC):	11:37:26
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 6401, Parent PID: 6236

General

Start time (UTC):	11:37:26
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 swodjwodjwoj \|\| busybox pkill -9 swodjwodjwoj"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6406, Parent PID: 6401

General

Start time (UTC):	11:37:26
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6406, Parent PID: 6401

General

Start time (UTC):	11:37:26
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 swodjwodjwoj
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6407, Parent PID: 6401

General

Start time (UTC):	11:37:27
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6407, Parent PID: 6401

General

Start time (UTC):	11:37:27
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 swodjwodjwoj
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 6408, Parent PID: 6236

General

Start time (UTC):	11:37:28
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 6408, Parent PID: 6236

General

Start time (UTC):	11:37:28
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 MmKiy7f87l \|\| busybox pkill -9 MmKiy7f87l"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6413, Parent PID: 6408

General

Start time (UTC):	11:37:28
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6413, Parent PID: 6408

General

Start time (UTC):	11:37:28
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 MmKiy7f87l
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6414, Parent PID: 6408

General

Start time (UTC):	11:37:29
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6414, Parent PID: 6408

General

Start time (UTC):	11:37:29
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 MmKiy7f87l
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 6417, Parent PID: 6236

General

Start time (UTC):	11:37:30
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 6417, Parent PID: 6236

General

Start time (UTC):	11:37:30
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 freecookiex86 \|\| busybox pkill -9 freecookiex86"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6422, Parent PID: 6417

General

Start time (UTC):	11:37:30
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6422, Parent PID: 6417

General

Start time (UTC):	11:37:30
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 freecookiex86
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6423, Parent PID: 6417

General

Start time (UTC):	11:37:31
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6423, Parent PID: 6417

General

Start time (UTC):	11:37:31
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 freecookiex86
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 6425, Parent PID: 6236

General

Start time (UTC):	11:37:32
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 6425, Parent PID: 6236

General

Start time (UTC):	11:37:32
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 sysgpu \|\| busybox pkill -9 sysgpu"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6431, Parent PID: 6425

General

Start time (UTC):	11:37:32
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6431, Parent PID: 6425

General

Start time (UTC):	11:37:32
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 sysgpu
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6432, Parent PID: 6425

General

Start time (UTC):	11:37:33
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6432, Parent PID: 6425

General

Start time (UTC):	11:37:33
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 sysgpu
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 6433, Parent PID: 6236

General

Start time (UTC):	11:37:34
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 6433, Parent PID: 6236

General

Start time (UTC):	11:37:34
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 NiGGeR69xd \|\| busybox pkill -9 NiGGeR69xd"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6438, Parent PID: 6433

General

Start time (UTC):	11:37:34
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6438, Parent PID: 6433

General

Start time (UTC):	11:37:34
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 NiGGeR69xd
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6441, Parent PID: 6433

General

Start time (UTC):	11:37:35
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6441, Parent PID: 6433

General

Start time (UTC):	11:37:35
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 NiGGeR69xd
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 6442, Parent PID: 6236

General

Start time (UTC):	11:37:36
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 6442, Parent PID: 6236

General

Start time (UTC):	11:37:36
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 frgege \|\| busybox pkill -9 frgege"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6447, Parent PID: 6442

General

Start time (UTC):	11:37:36
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6447, Parent PID: 6442

General

Start time (UTC):	11:37:36
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 frgege
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6448, Parent PID: 6442

General

Start time (UTC):	11:37:37
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6448, Parent PID: 6442

General

Start time (UTC):	11:37:37
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 frgege
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 6449, Parent PID: 6236

General

Start time (UTC):	11:37:38
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 6449, Parent PID: 6236

General

Start time (UTC):	11:37:38
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 sysupdater \|\| busybox pkill -9 sysupdater"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6454, Parent PID: 6449

General

Start time (UTC):	11:37:38
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6454, Parent PID: 6449

General

Start time (UTC):	11:37:38
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 sysupdater
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6457, Parent PID: 6449

General

Start time (UTC):	11:37:39
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6457, Parent PID: 6449

General

Start time (UTC):	11:37:39
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 sysupdater
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 6460, Parent PID: 6236

General

Start time (UTC):	11:37:40
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 6460, Parent PID: 6236

General

Start time (UTC):	11:37:40
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 0DnAzepd \|\| busybox pkill -9 0DnAzepd"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6464, Parent PID: 6460

General

Start time (UTC):	11:37:40
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6464, Parent PID: 6460

General

Start time (UTC):	11:37:40
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 0DnAzepd
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6466, Parent PID: 6460

General

Start time (UTC):	11:37:41
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6466, Parent PID: 6460

General

Start time (UTC):	11:37:41
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 0DnAzepd
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 6467, Parent PID: 6236

General

Start time (UTC):	11:37:42
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 6467, Parent PID: 6236

General

Start time (UTC):	11:37:42
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 NiGGeRD0nks69 \|\| busybox pkill -9 NiGGeRD0nks69"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6472, Parent PID: 6467

General

Start time (UTC):	11:37:42
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6472, Parent PID: 6467

General

Start time (UTC):	11:37:42
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 NiGGeRD0nks69
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6473, Parent PID: 6467

General

Start time (UTC):	11:37:43
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6473, Parent PID: 6467

General

Start time (UTC):	11:37:43
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 NiGGeRD0nks69
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 6474, Parent PID: 6236

General

Start time (UTC):	11:37:44
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 6474, Parent PID: 6236

General

Start time (UTC):	11:37:44
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 frgreu \|\| busybox pkill -9 frgreu"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6479, Parent PID: 6474

General

Start time (UTC):	11:37:44
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6479, Parent PID: 6474

General

Start time (UTC):	11:37:44
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 frgreu
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6482, Parent PID: 6474

General

Start time (UTC):	11:37:45
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6482, Parent PID: 6474

General

Start time (UTC):	11:37:45
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 frgreu
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 6483, Parent PID: 6236

General

Start time (UTC):	11:37:46
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 6483, Parent PID: 6236

General

Start time (UTC):	11:37:46
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 telnetd \|\| busybox pkill -9 telnetd"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6488, Parent PID: 6483

General

Start time (UTC):	11:37:46
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6488, Parent PID: 6483

General

Start time (UTC):	11:37:46
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 telnetd
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6489, Parent PID: 6483

General

Start time (UTC):	11:37:47
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6489, Parent PID: 6483

General

Start time (UTC):	11:37:47
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 telnetd
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 6490, Parent PID: 6236

General

Start time (UTC):	11:37:48
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 6490, Parent PID: 6236

General

Start time (UTC):	11:37:48
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 0x766f6964 \|\| busybox pkill -9 0x766f6964"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6496, Parent PID: 6490

General

Start time (UTC):	11:37:48
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6496, Parent PID: 6490

General

Start time (UTC):	11:37:48
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 0x766f6964
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6499, Parent PID: 6490

General

Start time (UTC):	11:37:49
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6499, Parent PID: 6490

General

Start time (UTC):	11:37:49
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 0x766f6964
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 6500, Parent PID: 6236

General

Start time (UTC):	11:37:50
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 6500, Parent PID: 6236

General

Start time (UTC):	11:37:50
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 NiGGeRd0nks1337 \|\| busybox pkill -9 NiGGeRd0nks1337"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6505, Parent PID: 6500

General

Start time (UTC):	11:37:50
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6505, Parent PID: 6500

General

Start time (UTC):	11:37:50
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 NiGGeRd0nks1337
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6506, Parent PID: 6500

General

Start time (UTC):	11:37:52
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6506, Parent PID: 6500

General

Start time (UTC):	11:37:52
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 NiGGeRd0nks1337
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 6507, Parent PID: 6236

General

Start time (UTC):	11:37:53
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 6507, Parent PID: 6236

General

Start time (UTC):	11:37:53
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 gaft \|\| busybox pkill -9 gaft"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6512, Parent PID: 6507

General

Start time (UTC):	11:37:53
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6512, Parent PID: 6507

General

Start time (UTC):	11:37:53
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 gaft
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6513, Parent PID: 6507

General

Start time (UTC):	11:37:54
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6513, Parent PID: 6507

General

Start time (UTC):	11:37:54
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 gaft
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 6516, Parent PID: 6236

General

Start time (UTC):	11:37:55
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 6516, Parent PID: 6236

General

Start time (UTC):	11:37:55
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 urasgbsigboa \|\| busybox pkill -9 urasgbsigboa"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6521, Parent PID: 6516

General

Start time (UTC):	11:37:55
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6521, Parent PID: 6516

General

Start time (UTC):	11:37:55
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 urasgbsigboa
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6522, Parent PID: 6516

General

Start time (UTC):	11:37:56
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6522, Parent PID: 6516

General

Start time (UTC):	11:37:56
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 urasgbsigboa
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 6523, Parent PID: 6236

General

Start time (UTC):	11:37:57
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 6523, Parent PID: 6236

General

Start time (UTC):	11:37:57
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 120i3UI49 \|\| busybox pkill -9 120i3UI49"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6528, Parent PID: 6523

General

Start time (UTC):	11:37:57
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6528, Parent PID: 6523

General

Start time (UTC):	11:37:57
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 120i3UI49
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6529, Parent PID: 6523

General

Start time (UTC):	11:37:58
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6529, Parent PID: 6523

General

Start time (UTC):	11:37:58
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 120i3UI49
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 6530, Parent PID: 6236

General

Start time (UTC):	11:37:59
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 6530, Parent PID: 6236

General

Start time (UTC):	11:37:59
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 OaF3 \|\| busybox pkill -9 OaF3"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6535, Parent PID: 6530

General

Start time (UTC):	11:37:59
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6535, Parent PID: 6530

General

Start time (UTC):	11:37:59
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 OaF3
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6538, Parent PID: 6530

General

Start time (UTC):	11:38:00
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6538, Parent PID: 6530

General

Start time (UTC):	11:38:00
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 OaF3
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 6539, Parent PID: 6236

General

Start time (UTC):	11:38:01
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 6539, Parent PID: 6236

General

Start time (UTC):	11:38:01
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 geae \|\| busybox pkill -9 geae"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6544, Parent PID: 6539

General

Start time (UTC):	11:38:01
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6544, Parent PID: 6539

General

Start time (UTC):	11:38:01
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 geae
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6546, Parent PID: 6539

General

Start time (UTC):	11:38:02
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6546, Parent PID: 6539

General

Start time (UTC):	11:38:02
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 geae
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 6547, Parent PID: 6236

General

Start time (UTC):	11:38:03
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 6547, Parent PID: 6236

General

Start time (UTC):	11:38:03
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 vaiolmao \|\| busybox pkill -9 vaiolmao"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6553, Parent PID: 6547

General

Start time (UTC):	11:38:03
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6553, Parent PID: 6547

General

Start time (UTC):	11:38:03
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 vaiolmao
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6554, Parent PID: 6547

General

Start time (UTC):	11:38:04
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6554, Parent PID: 6547

General

Start time (UTC):	11:38:04
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 vaiolmao
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 6557, Parent PID: 6236

General

Start time (UTC):	11:38:05
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 6557, Parent PID: 6236

General

Start time (UTC):	11:38:05
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 123123a \|\| busybox pkill -9 123123a"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6562, Parent PID: 6557

General

Start time (UTC):	11:38:05
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6562, Parent PID: 6557

General

Start time (UTC):	11:38:05
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 123123a
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6563, Parent PID: 6557

General

Start time (UTC):	11:38:06
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6563, Parent PID: 6557

General

Start time (UTC):	11:38:06
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 123123a
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 6564, Parent PID: 6236

General

Start time (UTC):	11:38:07
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 6564, Parent PID: 6236

General

Start time (UTC):	11:38:07
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 Ofurain0n4H34D \|\| busybox pkill -9 Ofurain0n4H34D"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6569, Parent PID: 6564

General

Start time (UTC):	11:38:07
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6569, Parent PID: 6564

General

Start time (UTC):	11:38:07
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 Ofurain0n4H34D
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6570, Parent PID: 6564

General

Start time (UTC):	11:38:08
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6570, Parent PID: 6564

General

Start time (UTC):	11:38:08
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 Ofurain0n4H34D
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 6571, Parent PID: 6236

General

Start time (UTC):	11:38:09
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 6571, Parent PID: 6236

General

Start time (UTC):	11:38:09
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 ggTrex \|\| busybox pkill -9 ggTrex"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6576, Parent PID: 6571

General

Start time (UTC):	11:38:09
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6576, Parent PID: 6571

General

Start time (UTC):	11:38:09
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 ggTrex
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6579, Parent PID: 6571

General

Start time (UTC):	11:38:10
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6579, Parent PID: 6571

General

Start time (UTC):	11:38:10
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 ggTrex
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 6580, Parent PID: 6236

General

Start time (UTC):	11:38:11
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 6580, Parent PID: 6236

General

Start time (UTC):	11:38:11
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 wasads \|\| busybox pkill -9 wasads"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6585, Parent PID: 6580

General

Start time (UTC):	11:38:11
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6585, Parent PID: 6580

General

Start time (UTC):	11:38:11
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 wasads
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6586, Parent PID: 6580

General

Start time (UTC):	11:38:12
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6586, Parent PID: 6580

General

Start time (UTC):	11:38:12
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 wasads
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 6587, Parent PID: 6236

General

Start time (UTC):	11:38:13
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 6587, Parent PID: 6236

General

Start time (UTC):	11:38:13
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 1293194hjXD \|\| busybox pkill -9 1293194hjXD"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6592, Parent PID: 6587

General

Start time (UTC):	11:38:13
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6592, Parent PID: 6587

General

Start time (UTC):	11:38:13
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 1293194hjXD
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6593, Parent PID: 6587

General

Start time (UTC):	11:38:14
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6593, Parent PID: 6587

General

Start time (UTC):	11:38:14
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 1293194hjXD
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 6596, Parent PID: 6236

General

Start time (UTC):	11:38:15
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 6596, Parent PID: 6236

General

Start time (UTC):	11:38:15
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 OthLaLosn \|\| busybox pkill -9 OthLaLosn"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6598, Parent PID: 6596

General

Start time (UTC):	11:38:15
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6598, Parent PID: 6596

General

Start time (UTC):	11:38:15
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 OthLaLosn
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6599, Parent PID: 6596

General

Start time (UTC):	11:38:16
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6599, Parent PID: 6596

General

Start time (UTC):	11:38:16
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 OthLaLosn
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 6600, Parent PID: 6236

General

Start time (UTC):	11:38:17
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 6600, Parent PID: 6236

General

Start time (UTC):	11:38:17
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 ggt \|\| busybox pkill -9 ggt"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6602, Parent PID: 6600

General

Start time (UTC):	11:38:17
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6602, Parent PID: 6600

General

Start time (UTC):	11:38:17
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 ggt
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6603, Parent PID: 6600

General

Start time (UTC):	11:38:18
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6603, Parent PID: 6600

General

Start time (UTC):	11:38:18
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 ggt
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 6606, Parent PID: 6236

General

Start time (UTC):	11:38:19
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 6606, Parent PID: 6236

General

Start time (UTC):	11:38:19
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 wget-log \|\| busybox pkill -9 wget-log"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6612, Parent PID: 6606

General

Start time (UTC):	11:38:19
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6612, Parent PID: 6606

General

Start time (UTC):	11:38:19
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 wget-log
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6613, Parent PID: 6606

General

Start time (UTC):	11:38:20
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6613, Parent PID: 6606

General

Start time (UTC):	11:38:20
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 wget-log
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 6614, Parent PID: 6236

General

Start time (UTC):	11:38:21
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 6614, Parent PID: 6236

General

Start time (UTC):	11:38:21
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 1337SoraLOADER \|\| busybox pkill -9 1337SoraLOADER"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6619, Parent PID: 6614

General

Start time (UTC):	11:38:21
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6619, Parent PID: 6614

General

Start time (UTC):	11:38:21
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 1337SoraLOADER
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6620, Parent PID: 6614

General

Start time (UTC):	11:38:22
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6620, Parent PID: 6614

General

Start time (UTC):	11:38:22
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 1337SoraLOADER
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 6621, Parent PID: 6236

General

Start time (UTC):	11:38:23
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 6621, Parent PID: 6236

General

Start time (UTC):	11:38:23
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 SAIAKINA \|\| busybox pkill -9 SAIAKINA"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6626, Parent PID: 6621

General

Start time (UTC):	11:38:23
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6626, Parent PID: 6621

General

Start time (UTC):	11:38:23
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 SAIAKINA
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6627, Parent PID: 6621

General

Start time (UTC):	11:38:24
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6627, Parent PID: 6621

General

Start time (UTC):	11:38:24
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 SAIAKINA
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 6630, Parent PID: 6236

General

Start time (UTC):	11:38:25
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 6630, Parent PID: 6236

General

Start time (UTC):	11:38:25
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 ggtq \|\| busybox pkill -9 ggtq"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6635, Parent PID: 6630

General

Start time (UTC):	11:38:25
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6635, Parent PID: 6630

General

Start time (UTC):	11:38:25
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 ggtq
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6637, Parent PID: 6630

General

Start time (UTC):	11:38:26
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6637, Parent PID: 6630

General

Start time (UTC):	11:38:26
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 ggtq
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 6638, Parent PID: 6236

General

Start time (UTC):	11:38:27
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 6638, Parent PID: 6236

General

Start time (UTC):	11:38:27
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 1378bfp919GRB1Q2 \|\| busybox pkill -9 1378bfp919GRB1Q2"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6643, Parent PID: 6638

General

Start time (UTC):	11:38:27
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6643, Parent PID: 6638

General

Start time (UTC):	11:38:27
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 1378bfp919GRB1Q2
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6644, Parent PID: 6638

General

Start time (UTC):	11:38:28
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6644, Parent PID: 6638

General

Start time (UTC):	11:38:28
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 1378bfp919GRB1Q2
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 6645, Parent PID: 6236

General

Start time (UTC):	11:38:29
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 6645, Parent PID: 6236

General

Start time (UTC):	11:38:29
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 SAIAKUSO \|\| busybox pkill -9 SAIAKUSO"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6650, Parent PID: 6645

General

Start time (UTC):	11:38:29
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6650, Parent PID: 6645

General

Start time (UTC):	11:38:29
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 SAIAKUSO
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6653, Parent PID: 6645

General

Start time (UTC):	11:38:30
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6653, Parent PID: 6645

General

Start time (UTC):	11:38:30
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 SAIAKUSO
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 6654, Parent PID: 6236

General

Start time (UTC):	11:38:31
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 6654, Parent PID: 6236

General

Start time (UTC):	11:38:31
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 ggtr \|\| busybox pkill -9 ggtr"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6658, Parent PID: 6654

General

Start time (UTC):	11:38:31
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6658, Parent PID: 6654

General

Start time (UTC):	11:38:31
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 ggtr
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6661, Parent PID: 6654

General

Start time (UTC):	11:38:32
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6661, Parent PID: 6654

General

Start time (UTC):	11:38:32
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 ggtr
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 6662, Parent PID: 6236

General

Start time (UTC):	11:38:33
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 6662, Parent PID: 6236

General

Start time (UTC):	11:38:33
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 14Fa \|\| busybox pkill -9 14Fa"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6668, Parent PID: 6662

General

Start time (UTC):	11:38:33
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6668, Parent PID: 6662

General

Start time (UTC):	11:38:33
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 14Fa
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6671, Parent PID: 6662

General

Start time (UTC):	11:38:34
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6671, Parent PID: 6662

General

Start time (UTC):	11:38:34
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 14Fa
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 6672, Parent PID: 6236

General

Start time (UTC):	11:38:35
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 6672, Parent PID: 6236

General

Start time (UTC):	11:38:35
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 SEXSLAVE1337 \|\| busybox pkill -9 SEXSLAVE1337"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6674, Parent PID: 6672

General

Start time (UTC):	11:38:35
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6674, Parent PID: 6672

General

Start time (UTC):	11:38:35
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 SEXSLAVE1337
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6675, Parent PID: 6672

General

Start time (UTC):	11:38:36
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6675, Parent PID: 6672

General

Start time (UTC):	11:38:36
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 SEXSLAVE1337
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 6676, Parent PID: 6236

General

Start time (UTC):	11:38:37
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 6676, Parent PID: 6236

General

Start time (UTC):	11:38:37
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 ggtt \|\| busybox pkill -9 ggtt"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6678, Parent PID: 6676

General

Start time (UTC):	11:38:37
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6678, Parent PID: 6676

General

Start time (UTC):	11:38:37
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 ggtt
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6681, Parent PID: 6676

General

Start time (UTC):	11:38:38
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6681, Parent PID: 6676

General

Start time (UTC):	11:38:38
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 ggtt
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 6684, Parent PID: 6236

General

Start time (UTC):	11:38:39
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 6684, Parent PID: 6236

General

Start time (UTC):	11:38:39
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 1902a3u912u3u4 \|\| busybox pkill -9 1902a3u912u3u4"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6686, Parent PID: 6684

General

Start time (UTC):	11:38:39
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6686, Parent PID: 6684

General

Start time (UTC):	11:38:39
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 1902a3u912u3u4
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6687, Parent PID: 6684

General

Start time (UTC):	11:38:40
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6687, Parent PID: 6684

General

Start time (UTC):	11:38:40
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 1902a3u912u3u4
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 6688, Parent PID: 6236

General

Start time (UTC):	11:38:41
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 6688, Parent PID: 6236

General

Start time (UTC):	11:38:41
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 SO190Ij1X \|\| busybox pkill -9 SO190Ij1X"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6693, Parent PID: 6688

General

Start time (UTC):	11:38:41
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6693, Parent PID: 6688

General

Start time (UTC):	11:38:41
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 SO190Ij1X
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6694, Parent PID: 6688

General

Start time (UTC):	11:38:42
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6694, Parent PID: 6688

General

Start time (UTC):	11:38:42
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 SO190Ij1X
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 6695, Parent PID: 6236

General

Start time (UTC):	11:38:43
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 6695, Parent PID: 6236

General

Start time (UTC):	11:38:43
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 haetrghbr \|\| busybox pkill -9 haetrghbr"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6697, Parent PID: 6695

General

Start time (UTC):	11:38:43
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6697, Parent PID: 6695

General

Start time (UTC):	11:38:43
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 haetrghbr
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6700, Parent PID: 6695

General

Start time (UTC):	11:38:44
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6700, Parent PID: 6695

General

Start time (UTC):	11:38:44
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 haetrghbr
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 6701, Parent PID: 6236

General

Start time (UTC):	11:38:45
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 6701, Parent PID: 6236

General

Start time (UTC):	11:38:45
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 19ju3d \|\| busybox pkill -9 19ju3d"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6706, Parent PID: 6701

General

Start time (UTC):	11:38:45
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6706, Parent PID: 6701

General

Start time (UTC):	11:38:45
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 19ju3d
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6707, Parent PID: 6701

General

Start time (UTC):	11:38:46
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6707, Parent PID: 6701

General

Start time (UTC):	11:38:46
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 19ju3d
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 6708, Parent PID: 6236

General

Start time (UTC):	11:38:47
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 6708, Parent PID: 6236

General

Start time (UTC):	11:38:47
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 SORAojkf120 \|\| busybox pkill -9 SORAojkf120"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6710, Parent PID: 6708

General

Start time (UTC):	11:38:47
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6710, Parent PID: 6708

General

Start time (UTC):	11:38:47
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 SORAojkf120
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6711, Parent PID: 6708

General

Start time (UTC):	11:38:48
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6711, Parent PID: 6708

General

Start time (UTC):	11:38:48
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 SORAojkf120
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 6714, Parent PID: 6236

General

Start time (UTC):	11:38:49
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 6714, Parent PID: 6236

General

Start time (UTC):	11:38:49
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 hehahejeje92 \|\| busybox pkill -9 hehahejeje92"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6716, Parent PID: 6714

General

Start time (UTC):	11:38:49
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6716, Parent PID: 6714

General

Start time (UTC):	11:38:49
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 hehahejeje92
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6717, Parent PID: 6714

General

Start time (UTC):	11:38:50
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6717, Parent PID: 6714

General

Start time (UTC):	11:38:50
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 hehahejeje92
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Analysis Process: yakuza.ppc.elf PID: 6718, Parent PID: 6236

General

Start time (UTC):	11:38:51
Start date (UTC):	28/12/2024
Path:	/tmp/yakuza.ppc.elf
Arguments:	-
File size:	5388968 bytes
MD5 hash:	ae65271c943d3451b7f026d1fadccea6

Analysis Process: sh PID: 6718, Parent PID: 6236

General

Start time (UTC):	11:38:51
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	sh -c "pkill -9 2U2JDJA901F91 \|\| busybox pkill -9 2U2JDJA901F91"
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: sh PID: 6724, Parent PID: 6718

General

Start time (UTC):	11:38:51
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: pkill PID: 6724, Parent PID: 6718

General

Start time (UTC):	11:38:51
Start date (UTC):	28/12/2024
Path:	/usr/bin/pkill
Arguments:	pkill -9 2U2JDJA901F91
File size:	30968 bytes
MD5 hash:	fa96a75a08109d8842e4865b2907d51f

Analysis Process: sh PID: 6725, Parent PID: 6718

General

Start time (UTC):	11:38:52
Start date (UTC):	28/12/2024
Path:	/bin/sh
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Analysis Process: busybox PID: 6725, Parent PID: 6718

General

Start time (UTC):	11:38:52
Start date (UTC):	28/12/2024
Path:	/usr/bin/busybox
Arguments:	busybox pkill -9 2U2JDJA901F91
File size:	2172376 bytes
MD5 hash:	70584dffe9cb0309eb22ba78aa54bcdc

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained. Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism. Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes.
Tactics:	Credential Access
Data Sources:	Application Log: Application Log Content, Command: Command Execution, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obfuscate command and control traffic to make it more difficult to detect. Command and control (C2) communications are hidden (but not necessarily encrypted) in an attempt to make the content more difficult to discover or decipher and to make the communication less conspicuous and hide commands from being seen. This encompasses many methods, such as adding junk data to protocol traffic, using steganography, or impersonating legitimate protocols.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report yakuza.ppc.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Malware Threat Intel

Yara Signatures

Initial Sample

Memory Dumps

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Networking

System Summary

Persistence and Installation Behavior

Malware Analysis System Evasion

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Symbols

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

System Behavior

Analysis Process: yakuza.ppc.elf PID: 6234, Parent PID: 6156

General

Chronological Activities

Analysis Process: yakuza.ppc.elf PID: 6236, Parent PID: 6234

General

Chronological Activities

Analysis Process: yakuza.ppc.elf PID: 6242, Parent PID: 6236

General

Chronological Activities

Analysis Process: yakuza.ppc.elf PID: 6243, Parent PID: 6236

General

Chronological Activities

Analysis Process: yakuza.ppc.elf PID: 6246, Parent PID: 6236

General

Chronological Activities

Linux Analysis Report
yakuza.ppc.elf